When attribute-based access control method is used, additional access check condition can be set in each policy rule. Executing additional condition depends on the access control check objective execution result and is taken into account when determining rule effect.
To create an additional access check condition:
Select the rule. After executing the operation, rule properties are displayed.
The additional access check condition is displayed in the Condition ox on the Properties side panel.
Click the 
button. After executing the operation, the Create Condition dialog box opens:
Set additional access check condition as a logical expression. To create an expression, use the attributes (operands), functions and operators.
For details see the Creating Formulas and Expressions section.
Click the OK button.
After executing the operations, an additional access check condition is set, its result is taken into account when determining rule effect. The specified expression will be displayed in the Condition box.
To edit additional access check condition:
Use the Condition box. The expression is edited manually.
NOTE. If the expression is incorrect, the box will be highlighted in red.
Use the Create Condition dialog box. The expression can be edited similarly to creating a step.
After executing the operations the expression will be changed in the Condition box and in the Create Condition dialog box.
To create an expression, the system and custom attributes that are contained in the attribute-based access control are available.
System attributes, for which a value based on information stored in the system, can be obtained, are divided into groups:
To control access permissions to MDM dictionary elements, use the object attribute as OBJECT.ELEMENT.<attribute identifier>. Element attribute identifiers are located on the Attributes tab when opening an MDM dictionary for edit.
NOTE. The element attribute is set only in the rule additional condition. When creating a condition, one can use only system and general attributes without multiple values.
If MDM dictionary elements have hierarchy, then on applying access control permissions to child elements, it is required to exclude parent element in additional access check condition. Exclude parent element using the KEY element attribute as the comparison condition OBJECT.ELEMENT.KEY > <parent element key>.
For example, MDM dictionary contains parent element with the 0 key and seven child elements with the 1,2,3,4,5,6,7 keys. When access is denied to child elements, which key is less than 5, the condition must take into account exclusion of parent element with the 0 key:
After executing the condition the parent element will be available containing child elements with the 5,6,7 keys. Child elements with the 1,2,3,4 keys will be unavailable.
To separate access permissions to MDM dictionary elements, see the Access Permissions for MDM Dictionary Elements section.
To create an expression, the following categories of system functions are used:
Attribute-based access control
See also:
Setting Up Attribute-Based Access Control Method | Adding Access Check Rules and Policies
