Managing Access to an Asset With ABAC
Sharing Access within your Tenant
Caution: You will only have access to the
Access Policiesscreen if you are a Root User in your Organization.
Attribute Based Access Control (ABAC) policies can be used to control access to Assets, their Attributes and Events within a single Organization.
Specifically, ABAC policies are created by Root Users to then share information with Non-Root Users in the same Tenancy.
ABAC policies can be granular, with users allowed to see only single Attributes at a time if wished.
It is possible to control policies based on types of Assets, their Location, and whether Users can read or write any information in an Asset.
By default, all Non-Root Users will not see any existing Assets and Events unless a Root User explicitly creates an ABAC policy to allow it.
Creating an ABAC Policy
Consider the Shipping Container Asset we created. There may be many people within an organization who need access to specific Attributes of the container.
We shall create a policy for someone who needs to share some standard dimensions of the Shipping Container, inspect the cargo and create
- Navigate to the
Access Policiessection on the Sidebar of the RKVST Dashboard.
- Here you will see any existing policies and can select
- When adding a Policy you will see this form:
- Here you can apply policy filters to the correct Assets.
In this case, we shall apply the policy to any Asset in the
UK Factory Location created earlier, as well as the type of Asset (
- Next, we select the
PermissionsTab to set Users' Asset and Event attribute access policy.
- In this example, the
Useractor implies an ABAC policy, identified by email. Type the relevant email address and hit Enter; you may also see a dropdown list of users within your tenancy.
- Once all relevant details are complete, then add the Permission Group to the policy. You may add multiple permission groups per policy if you wish.
Note we have included RKVST-sigificant attributes:
arc_* attributes have special significance in RKVST; in this case respectively allowing visibility to the Name, Description, and Location of the Asset. Other
arc_* attributes are also available.
- Once complete, select
Create Policyand check the Asset is appropriately shared.
Bill should only be allowed to see the Asset’s Name, Location, Length, and Weight Attributes.
For comparison with our Root User, Jill:
We can see that Bill can only view the Attributes as specified in the policy. He can also see the Event where we updated the Location.
Our Root User Jill, can see every detail associated with the Asset.