Managing Permissions

About Permissions

You use SAS Environment Manager to manage identities and authorization for SAS Viya. Information is available in the SAS Viya administration documentation:

• Authorization in SAS Viya in SAS Viya Platform: Orientation to Authorization
• Identity Management: Overview in SAS Viya Platform: Identity Management
• SAS Viya Platform: External Credentials

You can configure user access based on folders, object types, or specific objects. You can control which categories appear in the user interface by controlling access to root endpoints. To grant full access to an object, a user must have access to all of the service endpoints (object URIs) that are associated with the object. For more information, see Full Access and Service Endpoints.

The default permissions for SAS Intelligent Decisioning are described in Default Permissions.

Default Permissions

Rule sets, decisions, treatments, treatment groups, lookup tables, value lists, segmentation trees, and custom code files are stored in folders. When these objects are created through the user interface, the default permissions are determined by the folder in which the object is stored.

In SAS Environment Manager, each folder is assigned permissions that apply to the folder itself and permissions that apply to the objects within the folder. The permissions that apply to the objects within the folder are said to be conveyed to those objects within the folder.

Global variables and custom functions are not stored in folders. The default permissions for these objects are controlled by authorization rules.

By default, each member of the Authenticated Users group has permission to do the following:

• create rule sets, lookup tables, treatments, treatment groups, code files, global variables, custom functions, value lists, segmentation trees, and decisions in their own My Folder folder
• in the Decision Repository folder, check out and commit objects that they created
• create subfolders within the Decision Repository folder
• update and delete any rule set, lookup table, treatment, treatment group, code file, global variable, custom function, value list, segmentation tree, or decision that was created in a folder to which the user has conveyed Update and Delete access
• delete a specific version of a rule set, lookup table, treatment, treatment group, global variable, value list, segmentation tree, or decision if they have Delete permission for the object
• activate any lookup table, global variable, or treatment group that was created in a folder to which the user has conveyed Update access
• publish any rule set, decision, or model to which the user has Update access
• run a publishing validation test for any rule set, decision, or model that they published
• create a test definition, including scenario test definitions, for any rule set or decision to which the user has Read access
• update or delete the test definition that they created
• run the test and view the test results for any test definition that they created
• run a rule-fired analysis or decision-path tracking analysis and view the results for any test that they created and executed

Default folders such as a user’s My Folder folder or the Decision Repository folder are assigned permissions so that any subfolders that are created within these folders inherit the permissions of the parent folder (unless the parent folder’s permission have been customized). For folder’s that are created directly under SAS Content, you must set permissions in SAS Environment Manager in order to enable users to access these folders. See Folder-Based Permissions for more information.

Modifying Permissions

You can modify the default permissions in the following ways:

• Modify permissions for a specific folder and the objects that are stored in that folder by using the Edit Authorization window for the folder. For more information, see the following topics:
  • About Permission Types
  • Best Practices for Setting Permissions
  • SAS Viya: General Authorization Window
  • Folder-Based Permissions
• Modify the existing rules or create new rules. For more information, see the following topics:
  • About Permission Types
  • Best Practices for Setting Permissions
  • SAS Viya Platform: General Authorization
  • Rules Page in SAS Environment Manager: User’s Guide
  • SAS Viya: General Authorization Window
  • Tasks Enabled by Default Rules for Object URIs
  • Rules-Based Permissions
• Modify the existing user groups or create new ones. For more information, see the following topics:
  • Custom Groups in SAS Viya Platform: Identity Management
  • Manage Custom Groups in SAS Environment Manager: User’s Guide
  • Granting Access to Test Results

About Permission Types

There are two types of permissions that you might need to set for users to work in SAS Intelligent Decisioning: folder-based permissions and rules-based permissions.

Best Practices for Setting Permissions

To the extent possible, base your permission settings on the folders in which objects are stored. Use folders to organize objects according to which group of users need access to the objects. Customize the permission settings for your folders based on user groups, not on individual users.

Folder-Based Permissions

Rules-Based Permissions

Full Access and Service Endpoints

In order to have full access to an object, a user must have access to the folder that contains the object, to the specific object, to any additional objects that are referenced by the object, and to the service endpoints for all object types. For example, in order to have full access to a specific decision, the user must have access to the following:

• the folder that contains the decision.
• the folder that contains the test definition and test results.
• the decision, plus any rule sets, lookup tables, models, treatment groups, code files, global variables, custom functions, and nested decisions that are included in the decision.
• the service endpoints for the object types for the folder, the decision, and all of the objects that are included in the decision. If the decision contains a model, the endpoints for the model repository and the model project (if the model is in a project) must be included.
• the service endpoints for the object types that are needed to create and run a decision test: /scoreDefinitions/definitions and /scoreExecution/executions. Alternatively, if you are using the SASScoreUsers group, the user can be a member of the SASScoreUsers group. See Granting Access to Test Results for more information.
• the service endpoints that are needed to publish the decision: /modelPublish/destination and /modelPublish/destination/{destination}.

Service endpoints for specific object types are represented by the object URIs.These object URIs are shown in Tasks Enabled by Default Rules for Object URIs. You grant permissions for object URIs by creating or modifying rules in SAS Environment Manager. For more information, see Setting Rules-Based Permissions and Rules Page in SAS Environment Manager: User’s Guide.

Note: If a user has access to a decision but does not have access to an object that is referenced in the decision, SAS Intelligent Decisioning displays next to the object name.

Tasks Enabled by Default Rules for Object URIs

Permission rules for object URIs are defined in SAS Environment Manager. By default, general rules are defined for all object URIs in SAS Intelligent Decisioning. Tasks Enabled by Default Rules for Object URIs in SAS Intelligent Decisioning describes the tasks that are enabled by these default rules.

Granting Access to Test Results

Set Permissions for Check-Out Folders

If you create check-out folders outside of the /Decision Repository folder, you must manually set permissions for these folders in order to force users to check out the objects in these folders before modifying the objects. To manually set the permissions for check-out folders:

1. Click , and select Manage Environment.
2. Click , navigate to the folder, and copy the URI of the folder into your paste buffer. You paste this URI into the Object URI or Container URI fields in the New Rule window in subsequent steps.
3. Click to display the Rules page.
4. Click , and enter the values shown in the following table in the New Rule window.
   Note: For this step, enter the folder URI in the Object URI field.

   Permissions for Managing Folder Subdirectories

   Field	Value
   Object URI	Enter the URI of the check-out folder: /folders/folders/guid
   Principal type	Authenticated Users
   Rule type	Grant
   Permissions	Read, Add
   Description	Enable authenticated users to read and add subdirectories in the check-out folder.

5. Click Save.
6. Click , and enter the values shown in the following table in the New Rule window.
   Note: For this step and the remaining steps in this process, enter the folder URI in the Container URI field.

   Permissions for Managing Folder Contents

   Field	Value
   Container URI	Enter the URI of the check-out folder: /folders/folders/guid
   Principal type	Authenticated Users
   Rule type	Grant
   Permissions	Read, Add
   Description	Enable authenticated users to add items to and to read objects from the check-out folder.

7. Click Save.
8. Click , and enter the values shown in the following table in the New Rule window.

   Permissions for Committing Updated Versions

   Field	Value
   Container URI	Enter the URI of the check-out folder: /folders/folders/guid
   Principal type	Authenticated Users
   Rule type	Grant
   Condition	requestUri().endsWith('/revisions')
   Permissions	Update
   Description	Enable authenticated users to create new versions in the check-out folder.

9. Click Save.
10. Click , and enter the values shown in the following table in the New Rule window.

    Permissions for Committing Lookup Tables and Value Lists

    Field	Value
    Container URI	Enter the URI of the check-out folder: /folders/folders/guid
    Principal type	Authenticated Users
    Rule type	Grant
    Condition	requestUri().startsWith('/referenceData/domains/') && requestUri().contains('/contents') && !requestUri().endsWith('/entries')
    Permissions	Update
    Description	Enable authenticated users to commit lookup tables and value lists that are in the check-out folder.

11. Click Save.
12. Click , and enter the values shown in the following table in the New Rule window.

    Permissions for Activating Treatment Groups

    Field	Value
    Container URI	Enter the URI of the check-out folder: /folders/folders/guid
    Principal type	Authenticated Users
    Rule type	Grant
    Condition	requestUri().startsWith('/treatmentDefinitions/definitionGroups/') && requestUri().endsWith('/active')
    Permissions	Update
    Description	Enable authenticated users to activate treatment groups that are in the check-out folder.

13. Click Save.

Grant Permission to Create Versions in Check-Out Folders by Using Tags

For information about using tags to create a new version of a decision, see Creating a New Version by Using Tags in SAS Intelligent Decisioning: User’s Guide.

1. Sign in to SAS Environment Manager as an administrator.
   Note: If you are already logged in to SAS Intelligent Decisioning as an administrator, access SAS Environment Manager by clicking and selecting Manage Environment.
2. Create a new group for the users to whom you want to grant permission. For instructions, see Custom Groups in SAS Viya Platform: Identity Management.
3. Click to display the Rules page.
4. Click to open the New Rule window, and enter the values shown in the following table.

   Permissions for Creating Decision Versions in Check-Out-Enabled Folders by Using Tags

   Field	Value
   Object URI	Enter the following capability: /capability/sas/sid/createVersionFromTagInCheckoutFolder
   Principal type	Group
   Principal	Enter the name of the group that you created in Step 2.
   Rule type	Grant
   Permissions	Read
   Description	Enable users in the group group-name to create new versions of decisions that are in a check-out folder by using tags.

5. Click Save.

Configuring Support for Administering and Using Tags