Data Access Controls

Warning

This feature is currently in beta and may be subject to change. Before using it in production, please contact your Socotra representative.

Overview

Data access controls prevent users from viewing, creating, and editing entities based on field values for a given entity type. Policies, quotes, and accounts are the only entity types that currently support data access controls. Policies and quotes share the same data access control configuration.

Data access controls prevent users from accessing entities, unlike data masking, which prevents users from accessing specific fields within an entity.

By default, data access controls are disabled, but users will still be prevented from accessing entities if they don’t possess the necessary permissions.

Policy Fields

The following policy fields currently support data access controls:

  • productName

  • region

  • Extension data fields

Account Fields

The following account fields currently support data access controls:

  • Extension data fields

Note

Extension data fields must be specified at the root level of the extension data object.

Enabling Data Access Controls

Data access controls can be enabled through the DataAccessControlRef object in the tenant configuration.

DataAccessControlRef
required
dataMasking boolean
enabled boolean

To enable data access controls, set the enabled flag to true.

For example:

{
  "dataAccessControl": {
      "enabled": true
  }
}

Important

Before setting the enabled flag to true, configure data access controls to avoid unintentionally blocking access for users.

The policy and account properties can be used to specify which fields associated with policies or accounts will be used to determine whether a user can access a policy or account.

For example:

{
    "dataAccessControl": {
        "enabled": true,
        "policy": {
            "fields": ["productName", "region"]
        },
        "account": {
            "fields": ["data.region"]
        }
    }
}

Only field names can be specified here. Field values can be specified when configuring data access controls.

Extension data fields must be of type string with a list of pre-defined options.

Configuring Data Access Controls

The Add User Data Access API endpoint can be used to configure data access controls for a user in relation to a specific tenant. Only admins can configure data access controls.

The accessControlFields property in the UserDataAccessRequest can be used to specify permissible field values for a given entity type.

UserDataAccessRequest
required
maskingLevel Enum level1 | level2 | none
accessControlFields map<string,map<string,string[]>>

In order for a user to access an entity, the accessControlFields property must contain a matching value for all fields listed under the corresponding entity type. If any of the fields don’t have a matching value, the user will be prevented from accessing the entity and will receive a 403 Forbidden response.

For example:

{
    "accessControlFields": {
        "policy": {
            "productName": ["CommercialProperty"],
            "region": ["North", "South"]
        },
        "account": {
            "data.region": ["North", "South"]
        }
    }
}

In the example above, the user would be allowed to access a policy where the productName field is set to CommercialProperty and the region field is set to North. The user would not be allowed to access a policy where the productName field is set to CommercialProperty and the region field is set to West.

Wildcard Values

Specify all possible values for a given field using the following format:

{
    "accessControlFields": {
        "account": {
            "data.region": ["*"]
        }
    }
}

Next Steps

See Also