{"id":22171,"date":"2026-07-28T06:41:25","date_gmt":"2026-07-28T06:41:25","guid":{"rendered":"https:\/\/tenthplanet.in\/idempiere\/?p=22171"},"modified":"2026-08-13T04:51:05","modified_gmt":"2026-08-13T04:51:05","slug":"how-role-data-access-window-works-in-idempiere","status":"publish","type":"post","link":"https:\/\/tenthplanet.in\/idempiere\/how-role-data-access-window-works-in-idempiere\/","title":{"rendered":"How Role Data Access Window Works in iDempiere"},"content":{"rendered":"\n

Introduction<\/strong><\/h2>\n\n\n\n

The Role Data Access window lets an administrator fine-tune what a specific Role can see or change, going beyond the general access already granted through the Role and Organization setup.<\/p>\n\n\n\n

It is used in System Administration, whenever a business needs a role restricted on a particular table, a single field, or a single record, instead of an entire window or menu.<\/p>\n\n\n\n

These rules directly affect daily transactions and reporting, because a restricted role will not be able to view, edit, or report on the data covered by the rule.<\/p>\n\n\n\n

Process Flow<\/strong><\/h2>\n\n\n\n
\"TenthPlanet-iDempiere-SystemAdimin-RoleDataAccess-ProcessFlow\"<\/figure>\n\n\n\n

Business Rules<\/strong><\/h2>\n\n\n\n
    \n
  • Rules set here apply only to the specific Role selected, not to every role in the tenant.<\/li>\n\n\n\n
  • A Table Access rule works together with, and can further limit, the role’s standard access level.<\/li>\n\n\n\n
  • Include with Read Only means the role can view the table but cannot add or change records.<\/li>\n\n\n\n
  • Exclude with Read Only removes edit rights while the role can still view the data.<\/li>\n\n\n\n
  • Exclude without Read Only removes both view and edit rights to the table.<\/li>\n\n\n\n
  • Column Access rules hide or restrict one field without restricting the whole table.<\/li>\n\n\n\n
  • Record Access rules apply to individual records, most often created through the Lock feature.<\/li>\n\n\n\n
  • Role details shown at the top of this window are for reference only and cannot be edited here.<\/li>\n\n\n\n
  • Access changes are cached, so affected users must log out and log back in to see the change.<\/li>\n<\/ul>\n\n\n\n

    Prerequisites<\/strong><\/h2>\n\n\n\n
      \n
    • Role already created and saved in the Role window.<\/li>\n\n\n\n
    • Organization and Client setup completed for the tenant.<\/li>\n\n\n\n
    • Table, Column, and Window entries available in the Application Dictionary.<\/li>\n\n\n\n
    • Login using System Administrator, or a role with System Admin menu access.<\/li>\n\n\n\n
    • Records to be restricted already exist, if Record Access is being configured.<\/li>\n<\/ul>\n\n\n\n

      Navigation<\/strong><\/h2>\n\n\n\n
      Menu \u2192 System Admin \u2192 General Rules \u2192 Security \u2192 Role Data Access<\/strong><\/code><\/pre>\n\n\n\n
      \"TenthPlanet-iDempiere-SystemAdimin-RoleDataAccess-1\"<\/figure>\n\n\n\n

      Opening the window shows the selected Role’s details at the top of the screen, displayed for reference only. Below this, three tabs appear: Table Access, Column Access, and Record Access, where the actual restriction rules are added, reviewed, or removed.<\/p>\n\n\n\n
      Note:<\/strong> The Role panel at the top of this window is read-only by design, for every role that opens it, including System Administrator. Role details such as name and preference level are maintained in the separate Role window, not here.<\/code><\/pre>\n\n\n\n
      \"TenthPlanet-iDempiere-SystemAdimin-RoleDataAccess-2\"<\/figure>\n\n\n\n
      Configuration Steps<\/strong><\/h2>\n\n\n\n
      Step 1: Select the Role to Restrict<\/strong><\/strong><\/h3>\n\n\n\n
      Every rule created in this window applies to one Role at a time, so the correct role must be selected before any restriction is added.<\/p>\n\n\n\n
      Instructions<\/strong><\/h3>\n\n\n\n
      Use Select Query or the navigation arrows to open the target Role, for example POTS Admin. Confirm the correct Tenant and Organization appear before proceeding.<\/p>\n\n\n\n
      Field<\/strong><\/td>Sample Value<\/strong><\/td>Description<\/strong><\/td><\/tr><\/thead>
      Tenant<\/td>POTS<\/td>Business entity the role belongs to.<\/td><\/tr>
      Organization<\/td>*<\/td>Organization scope; * means all organizations.<\/td><\/tr>
      Name<\/td>POTS Admin<\/td>Role being restricted.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      Step 2: Review the Role Reference Panel<\/strong><\/strong><\/h3>\n\n\n\n
      Before adding rules, confirm the role’s existing permission flags, since these settings affect how far a new restriction reaches.<\/p>\n\n\n\n
      Instructions<\/strong><\/h3>\n\n\n\n
      Check flags such as Show Accounting, Can Report, Can Export, and Access all Orgs. These fields are read-only here and must be changed in the Role window instead.<\/p>\n\n\n\n
      Field<\/strong><\/td>Sample Value<\/strong><\/td>Description<\/strong><\/td><\/tr><\/thead>
      Preference Level<\/td>Client<\/td>Level at which preference values apply for this role.<\/td><\/tr>
      Access all Orgs<\/td>Unchecked<\/td>Whether the role can see every organization.<\/td><\/tr>
      Can Export<\/td>Checked<\/td>Whether the role is allowed to export data.<\/td><\/tr>
      Can Report<\/td>Checked<\/td>Whether the role is allowed to run reports.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      Step 3: Restrict Table Access<\/strong><\/strong><\/h3>\n\n\n\n
      Table Access rules stop a role from viewing or changing an entire table, useful when a role should never touch sensitive information such as costing or payroll data.<\/p>\n\n\n\n
      Instructions<\/strong><\/h3>\n\n\n\n
      Open the Table Access tab, click the New Record icon, choose the Table, mark Active, and set Exclude or Read Only depending on the level of restriction needed. Save the record.<\/p>\n\n\n\n
      Field<\/strong><\/td>Sample Value<\/strong><\/td>Purpose<\/strong><\/td><\/tr><\/thead>
      Table<\/td>M_Product<\/td>Table the rule applies to.<\/td><\/tr>
      Active<\/td>Checked<\/td>Enables the rule immediately.<\/td><\/tr>
      Exclude<\/td>Checked<\/td>Removes access instead of granting it.<\/td><\/tr>
      Read Only<\/td>Checked<\/td>Allows viewing without allowing edits.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      Step 4: Restrict Column Access<\/strong><\/strong><\/h3>\n\n\n\n
      Column Access rules hide or lock a single field, useful when only one piece of information, such as a cost or margin field, needs to stay hidden from a role.<\/p>\n\n\n\n
      Instructions<\/strong><\/h3>\n\n\n\n
      Open the Column Access tab, click the New Record icon, select the Table and the specific Column, then mark Exclude or Read Only as required. Save the record.<\/p>\n\n\n\n
      Field<\/strong><\/td>Sample Value<\/strong><\/td>Purpose<\/strong><\/td><\/tr><\/thead>
      Table<\/td>M_Product<\/td>Table that owns the restricted column.<\/td><\/tr>
      Column<\/td>PriceCost<\/td>Specific field being restricted.<\/td><\/tr>
      Read Only<\/td>Checked<\/td>Column stays visible but cannot be edited.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      Step 5: Restrict Record Access<\/strong><\/h3>\n\n\n\n
      Record Access rules restrict a single record rather than a whole table, commonly used to keep one sensitive document private to certain roles.<\/p>\n\n\n\n
      Instructions<\/strong><\/h3>\n\n\n\n
      Open the record to restrict, use the Lock toolbar button while holding Ctrl to create a Record Access entry, then confirm the entry under the Record Access tab for the selected role.<\/p>\n\n\n\n
      Field<\/strong><\/td>Sample Value<\/strong><\/td>Purpose<\/strong><\/td><\/tr><\/thead>
      Table<\/td>C_Invoice<\/td>Table that owns the locked record.<\/td><\/tr>
      Record<\/td>Invoice 1000123<\/td>Specific record being restricted.<\/td><\/tr>
      Exclude<\/td>Checked<\/td>Removes this role’s access to the record.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      Step 6: Apply the Changes<\/strong><\/h3>\n\n\n\n
      New or changed rules do not affect an active session immediately, since role access information is cached for performance.<\/p>\n\n\n\n
      Instructions<\/strong><\/h3>\n\n\n\n
      Ask affected users to log out and log back in, or reset the cache from System Administration, then confirm the restriction behaves as expected.<\/p>\n\n\n\n
      <\/p>\n\n\n\n
      Common Issues and Resolutions<\/strong><\/strong><\/h2>\n\n\n\n
      Issue<\/strong><\/td>Cause<\/strong><\/td>Resolution<\/strong><\/td><\/tr><\/thead>
      Restriction not taking effect<\/td>Access information is cached<\/td>Log out and log back in, or reset the cache from System Administration.<\/td><\/tr>
      Role panel fields cannot be edited<\/td>Role tab in this window is read-only by design<\/td>Edit role details, such as name or flags, in the Role window instead.<\/td><\/tr>
      Role suddenly loses access to related windows<\/td>Include rule was added without its supporting tables<\/td>Add the related supporting tables, or restrict access using functionality instead of Include rules.<\/td><\/tr>
      Record Access entry not created<\/td>Lock button was used without holding Ctrl<\/td>Hold Ctrl while clicking Lock to generate a Record Access entry for the role.<\/td><\/tr>
      Restricted table still reachable<\/td>User navigated using the Zoom function<\/td>Add a Table Access rule here, since menu removal alone does not block data access.<\/td><\/tr>
      Column still visible in a print or export<\/td>Column Access rule not linked to that report<\/td>Check whether the report or process reads the column directly and restrict it separately if needed.<\/td><\/tr>
      Read Only not enforced on a record<\/td>A broader Table Access rule overrides the record rule<\/td>Review Table Access and Record Access together, since table-level rules are evaluated first.<\/td><\/tr>
      Wrong role restricted<\/td>Similar role names in the same tenant<\/td>Confirm Tenant, Organization, and Role name before saving any new rule.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      Next Steps<\/strong><\/h2>\n\n\n\n
        \n
      • Review the Role window to manage menu access and organization access.<\/li>\n\n\n\n
      • Check Table Access levels defined at the system level for each table.<\/li>\n\n\n\n
      • Test the restriction by logging in as a user assigned to the affected role.<\/li>\n\n\n\n
      • Document each restriction rule for future audit and support reference.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
        Introduction The Role Data Access window lets an administrator fine-tune what a specific Role can see or change, going beyond […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[91,10],"tags":[],"class_list":["post-22171","post","type-post","status-publish","format-standard","hentry","category-idempiere-general-rules","category-idempiere-product"],"_links":{"self":[{"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/posts\/22171","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/comments?post=22171"}],"version-history":[{"count":3,"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/posts\/22171\/revisions"}],"predecessor-version":[{"id":22264,"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/posts\/22171\/revisions\/22264"}],"wp:attachment":[{"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/media?parent=22171"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/categories?post=22171"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/tags?post=22171"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}