Security Rules
Security Rules are application-wide access control rules. Each rule defines who it applies to (Security Dimensions) and what it applies to (Securable Objects), and sets the access level for that combination. Rules work alongside the per-resource security settings on navigation items, Database Workflows, and Server Functions - this screen manages broader, cross-cutting rules in one place.
The Security Rules screen
Section titled “The Security Rules screen”Navigate to Security - Rules to see all security rules in the current application:
| Column | Description |
|---|---|
| Security Rule Name | Human-readable name |
| Security Rule ID | Unique identifier |
| All Security Dimensions | Whether the rule applies to all users rather than specific users/roles |
| All Securable Objects | Whether the rule applies to all objects of the target type |
| Securable Object Target | What kind of thing is being secured: Entity Fields, Functions, Portals, or Navigation Items |
| Securable Subject Type | The user scope: All Application Users, or Anyone (including anonymous) |
| Security Rule Order | Numeric value; higher order = higher priority when rules of the same specificity conflict |
Use + Add Rule to create a new rule, and the row checkboxes plus Delete to remove rules in bulk.
Creating a security rule
Section titled “Creating a security rule”Step 1 - Rule identity and target
Section titled “Step 1 - Rule identity and target”| Field | Description |
|---|---|
| Security Rule Name | Human-readable name |
| Security Rule ID | Auto-generated from the name |
| Securable Object Target | What this rule secures: Entity Fields, Functions, Portals, or Navigation Items |
Step 2 - Security Dimensions
Section titled “Step 2 - Security Dimensions”Security Dimensions define who the rule applies to.
All Security Dimensions (checkbox) - when checked, the rule applies to all users without specifying individuals. An additional option appears:
| Option | Description |
|---|---|
| All Users Type | Signed-In Users Only - the rule applies to authenticated users; Signed-In and Anonymous Users - the rule also applies to unauthenticated visitors |
When All Security Dimensions is unchecked, the rule applies to specific users or roles. Click into the Security Dimensions sub-panel to add one or more entries - each entry is either a User (a specific identity) or a Role, with a picker to select the target. Multiple dimensions can be added to a single rule.
Step 3 - Securable Objects
Section titled “Step 3 - Securable Objects”Securable Objects define what the rule applies to.
All Securable Objects (checkbox) - when checked, the rule applies to every object of the selected target type. The access level is set here:
- For Entity Fields: No Access, Read Only, or Read and Write
- For Functions, Portals, and Navigation Items: Allow or Forbid
When All Securable Objects is unchecked, the rule applies to a specific object. Click into the Securable Objects sub-panel to configure:
Securable Object Type - the level of specificity within the target. The options vary by Securable Object Target:
| Securable Object Target | Available object types (most general to most specific) |
|---|---|
| Entity Fields | Application, Application Module, Entity, Entity Component, Entity Field |
| Functions | Application, Application Module, Function |
| Portals | Application, Portal |
| Navigation Items | Application, Navigation Item |
After selecting the type, a picker appears to choose the specific object (for example, selecting Entity prompts you to pick which entity).
Access Level follows the same logic as All Securable Objects: No Access / Read Only / Read and Write for Entity Fields, Allow / Forbid for everything else.
Rule priority and ordering
Section titled “Rule priority and ordering”When multiple rules apply to the same user and resource, specificity wins:
- A rule targeting a specific User or Role wins over a rule for All Security Dimensions.
- Among rules of equal specificity, the Security Rule Order determines priority: a higher order number takes precedence over a lower one.
This means you can set a broad default with a low-order All Security Dimensions rule, then override it for specific users or roles with higher-order targeted rules.