Security Scenario

Below is an example security scenario. Remember that CSM is highly configurable, so individual Users/Customers, Security Groups, Roles, and Teams/Workgroups will vary.

Andrew, Gina, Sawyer, Tracy, and John work at the River T Corp. organization:

• Andrew is a System Administrator and is assigned to the Admin User Security Group. As a member of this group, Andrew has security rights to access all data and functionality in the system. This means Andrew has Allow, Run, View, Add, Edit, and Delete rights for all CSM Administrator functionality (security, Blueprints, e-mail setup, etc.), CSM functionality (Dashboards, One-Step Actions, etc.), and Business Object data (Incidents, Problems, etc.). In short, Andrew is a superuser and has rights to do just about anything in CSM. Because Service Desk and Service Desk Manager are legal Roles for the Admin Security Group, Andrew can log in using either of those Roles, and therefore has access to different environments (Dashboards, Forms, etc.).

  Andrew is also a member of two User Teams (2nd Level Support and Knowledge Management), and can therefore share CSM Items (example: Dashboards), support processes (Queues and Knowledge Article publishing/approvals), and record ownership (if configured) with the other members of those Teams. Andrew can use either the Desktop Client to access data or the Browser Client to log in via his web browser.

  Note: Andrew can also function as a Customer to other parts of the organization (example: HR). As a Customer, Andrew is a member of the Portal Customer Security Group and the Information Technology Customer Workgroup. See below for more details about Customers.
• Gina is the Service Desk Manager and is assigned to the Service Desk Manager User Security Group. As a member of this Security Group, Gina has security rights to Allow, View, Add, Edit, and Delete most data in the system (Incidents, Problems, etc.) but has limited security rights to functionality (example: Gina can View, Add, Edit, and Delete Team and User Dashboards but cannot edit system security). Because Service Desk Manager is the only legal Role for the Service Desk Manager Security Group, Gina can log in using only that Role. Her default environment (Dashboards, Forms, etc.) is appropriate for her managerial Role.

  Gina is also a member of two User Teams (CAB and IT Management) and can therefore share CSM Items (example: Dashboards), support processes (example: Queues), and record ownership (if configured) with the other members of that Team. Gina can use either the Desktop Client to access data or the Browser Client to log in via her web browser.

  Note: Gina can also function as a Customer to other parts of the organization (example: HR). As a Customer, Gina is a member of the Portal Workgroup Manager Security Group and the Information Technology Customer Workgroup. See below for more details about Customers.
• Sawyer is a Service Desk Worker who reports to Gina and is assigned to the Service Desk User Security Group. As a member of this Security Group, Sawyer has limited security rights to both data and functionality. For example, Sawyer can View but cannot Add, Edit, or Delete Team Dashboards; Sawyer can, however, View, Add, Edit, and Delete User Dashboards. Because Service Desk is the only legal Role for the Service Desk Security Group, Sawyer can log in using only that Role. His default environment (Dashboards, Forms, etc.) is appropriate for his troubleshooting Role.

  Sawyer is also a member of the 1st Level Support User Team and can therefore share CSM Items (example: Dashboards), support processes (example: Queues), and record ownership (if configured) with other members of that Team. Sawyer can use either the Desktop Client to access data or the Browser Client to log in via his web browser.

  Note: Sawyer can also function as a Customer to other parts of the organization (example: HR). As a Customer, Sawyer is a member of the Portal Customer Security Group and the Information Technology Customer Workgroup. See below for more details about Customers.
• Tracy is a Shipping Specialist and a Customer, meaningshe is an employee but not a licensed CSM User. Tracy is a Customer who uses the CSM Customer Portal to find company information and log Incidents for a service or product (example: She can log an Incident that her printer is not working). Tracy logs in to the Customer Portal using her default assigned Portal Customer Security Group, which has very limited security rights. Tracy can view and edit her own records (example: Incidents) but has very limited access to functionality.

  Tracy is a member of the Shipping Customer Workgroup and can therefore share CSM Items and record ownership (if configured) with other members of that Workgroup.

• John is the Production Manager and a Customer Manager, meaning he is an employee but not a licensed CSM User. John is Tracy's manager and also a Customer. John can log in to the Customer Portal to log Incidents using his default assigned Portal Workgroup Manager Security Group, which has very limited security rights. Like most Customers, John can view and edit his own records (example: Incidents) but has very little access to functionality; however, unlike Tracy, John is a manager, so he has extended rights to view and edit Tracy's records, as well.

  John is also a member of the Shipping Customer Workgroup and can therefore share CSM Items and record ownership (if configured) with other members of that Workgroup.

The following table provides a nice visual to see how the layers trickle down the security rights.