The access management system in Higson Studio is structured around three core components:

1. Users
2. Roles – Bundles of grants defining what a user can access and do.
3. Grants – Specific rights that enable or restrict actions within the platform. Each user can be assigned one or more roles, and each role consists of a set of grants. This design allows for a secure, scalable, and flexible access model, supporting the principle of least privilege.

Below is a table outlining the available grants categorized by their function:

Default Roles in Higson Studio#

The system defines the following default roles:

Examples of Role Configurations#

Profile-Specific Role

When a new profile is created, two grants are generated:

• PROFILE_READ_<PROFILE_NAME>
• PROFILE_WRITE_<PROFILE_NAME>

To create a role that grants access only to global elements and the DEMO profile, assign the following grants:

• PROFILE_READ_DEMO
• PROFILE_WRITE_DEMO
• RULE_ELEMENTS_READ
• RULE_ELEMENTS_WRITE

Such a user:

• Will not have access to other profiles and their domain and context.
• Will see global elements and elements assigned to regions within the DEMO profile only.

Access-Control Tag Role

When a tag with access control is created (via Menu → Tools → Tags), the system generates grants:

• TAG_READ_<TAG_NAME>
• TAG_WRITE_<TAG_NAME>

These grants are listed under Tools → Users → Grants.

To grant access only to elements tagged with a specific tag:

• TAG_READ_<TAG_NAME>
• TAG_WRITE_<TAG_NAME>

To grant access to both tagged and global elements:

• TAG_READ_<TAG_NAME>
• TAG_WRITE_<TAG_NAME>
• RULE_ELEMENTS_READ
• RULE_ELEMENTS_WRITE

To grant access to all tagged and global elements:

• RULE_ELEMENTS_READ_ALL
• RULE_ELEMENTS_WRITE_ALL

Grant Codes Since Version 4.1#

It is also important to note that only users with administrator privileges can create users, define roles, and assign grants to others.

Roles are the set of selected grants, multiple grants may be assigned to one Role. Roles screen contains information about all roles that are created.

In order to see Roles, select Tools → Users in Main Toolbar.

Then, select Roles tab.

After you enter Roles you will see screen of all Roles:

You can switch between Grants, Roles and Users screens by left-clicking on the desired Tab.

Add Role#

If you want to add a new role, follow these steps:

1. Choose Tools → Users in Main toolbar.

2. Switch to Roles tab.

3. Choose Add role.

   

   a. Choosing Add role opens Role screen.

   

4. In Description section you:

   a. need to enter unique role code/name. Code/name can contain only characters from collection a-z; 0-9; “.”; “-”; “_” and it can’t start with „-’'.

   i. If you enter illegal characters in name field, then borders will be highlighted with red color, and you will not be able to save a role.

   

   b. need to provide role Description

5. In the Grants section, you can select one or more grants to assign to a role.

6. Choose Save changes.

   a. Role with entered data is created.

   b. If you enter the same name as one of the Roles already created, then validation error will appear.

Download Roles#

If you want to download data of all roles currently in the environment, follow these steps:

1. Choose Tools → Users in Main toolbar.

2. Switch to Roles tab.

3. Choose Download roles.

   

   a. Choosing Download roles downloads an XLSX file that contains data of all roles currently in the environment.

Upload Roles#

If you want to upload roles, follow these steps:

1. Choose Tools → Users in Main toolbar.

2. Switch to Roles tab.

3. Choose Upload roles.

   

   a. Choosing Upload roles brings up Upload roles screen.

   

4. Drag&drop desired file or Click to upload a file and choose file in File explorer.

   a. If you choose a file with extension other than XLSX, then validation error will pop up.

   

5. Choose Upload.

   a. If there is something wrong with data in XLSX file, then validation error will appear.

6. When the progress bar reaches 100%, it means that file was uploaded correctly.

   a. If a validation error occurs (see above), then an upload process is being aborted.

Delete Role#

If you want to delete a specific role, follow these steps:

1. Choose Tools → Users in Main toolbar.

2. Switch to Roles tab.

3. Choose Delete role(bin icon) action for a role you wish to delete.

   

   b. After choosing Delete role action, confirmation pop-up will appear.

   

4. Choose Confirm.

   a. Specific Role is being deleted from the environment. This action is irreversible.

Users’ screen contains information about all users that are created. Only those users have access to Higson module that you are working on. In order to see Users, select Tools → Users in Main Toolbar.

After you enter Users you will see screen of all Users:

You can switch between Grants, Roles and Users screens by left-clicking on the desired Tab.

You can see all Filters available in Users tab below:

Number in Hide/Show filters action indicates how many filters are active.

All actions visible in a quick access action list are listed below:

Add User#

If you want to add a new user, follow these steps:

1. Choose Tools → Users in Main toolbar.

2. Choose Add user

   

   a. Choosing Add user opens a step-by-step Add a new user wizard.

   

3. In step 1. Data, you:

   a. need to provide unique user’s login. Login can contain only characters from collection a-z; 0-9; “.”; “-”; “_” and it can’t start with “@”.

   b. need to provide user’s First name. First name can contain only characters from collection a-z; diacritical marks; space; “-”.

   c. need to provide user’s Last name. Last name can contain only characters from collection a-z; diacritical marks; space; “-”.

   d. need to provide unique user’s e-mail address. E-mail address can contain only characters from collection a-z; 0-9; “.”; “-”; “_”; “@”.

4. Choose Next.

   a. If you enter illegal characters in any field, then adequate validation error will appear.

   i. For Login field

   ii. For First name field

   iii. For Last name field

   iv. For Email field

   b. If you enter Login or Email already used by another account, then adequate validation error will appear.

   i. For Login field

   ii. For Email field

5. In step 2. User roles you can assign Roles from a drop-down list. You can select multiple roles. This step is optional to add user.

   

6. Choose Next.

7. In step 3. Account registration you can select if you want to manually set password for user, or you can send activation link to the e-mail address entered in step 1. Data.

   

   a. Bear in mind, that Activation link option is only available when property higson.studio.security.password.send-reset-tokens is configured within dedicated file application.properties or higson.properties

   b. If you choose the Password option, then there are a few Password requirements that need to be met in order to save an account. These requirements are:

   i. 10-128 characters—password can’t be shorter than 10 characters and can’t be longer than 128 characters

   ii. Lower case letter (a-z) - password must contain at least one lower case letter

   iii. No more than 2 identical characters in a row - you can’t type more than two identical characters in a row i.e. CC; cc; Cc is acceptable but CCC; ccc; CcC is not

   iv. New and confirmed password have to match - password typed in New password and Confirm new password must be exactly the same.

   v. Number (0-9) - password must contain at least one number

   vi. Uppercase letter (A-Z) - password must contain at least one upper case letter

   vii. Special character - password must contain at least one special character i.e. !; @; #; $; %; etc.

8. Choose Save account.

   a. Account with entered data is created.

   b. If Password requirements aren’t met, then adequate requirement will be highlighted with red color, and you will not be able to save an account.

   

Download Users#

If you want to download data of all users currently in the environment, follow these steps:

1. Choose Tools → Users in Main toolbar.

2. Choose Download users.

   

   a. Choosing Download users downloads a XLSX file, that contains data of all users currently in the environment.

Upload Users#

If you want to upload users, follow these steps:

1. Choose Tools → Users in Main toolbar.

2. Choose Upload users.

   

   a. Choosing Upload users brings up Upload users screen.

   

3. Drag&drop desired file or Click to upload a file and choose file in File explorer.

   a. If you choose a file with extension other than XLSX, then validation error will pop up.

   

4. Choose Upload.

5. When the progress bar reaches 100%, it means that file was uploaded correctly.

   a. If a validation error occurs (see above), then an upload process is being aborted.

Edit User#

If you want to edit data of a specific user, follow these steps:

1. Choose Tools → Users in Main toolbar.

2. Choose Edit action for the desired user.

   

   a. Highlighted borders indicate that edit mode is active

   

3. Edit any data you need:

   a. Login can contain only characters from collection a-z; 0-9; “.”; “-”; “_” and it can’t start with “@”.

   b. First name can contain only characters from collection a-z; diacritical marks; space; “-”.

   c. Last name can contain only characters from collection a-z; diacritical marks; space; “-”.

   d. E-mail address can contain only characters from collection a-z; 0-9; “.”; “-”; “_”; “@”.

4. Choose Save.

   a. User’s account data is being updated.

   b. If you enter illegal characters in any field, then adequate validation error will appear.

   i. For Login field

   ii. For First name field

   iii. For Last name field

   iv. For Email field

   c. If you entered Login or Email already used by another account, then adequate validation error will appear.

   i. For Login field

   ii. For Email field

Update User’s Password#

If you want to update the password of a specific user, follow these steps:

1. Choose Tools → Users in Main toolbar.

2. Choose Update password action for desired user.

   

   a. Choosing Update password brings up Update password screen.

   

3. Enter new password in New password and Confirm new password fields.

   a. There are a few Password requirements that need to be met in order to update password. These requirements are:

   i. 10-128 characters - password can’t be shorter than 10 characters and can’t be longer than 128 characters

   ii. Lower case letter (a-z) - password must contain at least one lower case letter

   iii. No more than 2 identical characters in a row - you can’t type more than two identical characters in a row i.e. CC; cc; Cc is acceptable but CCC; ccc; CcC is not

   iv. New and confirmed password have to match - password typed in New password and Confirm new password must be exactly the same.

   v. Number (0-9) - password must contain at least one number

   vi. Uppercase letter (A-Z) - password must contain at least one upper case letter

   vii. Special character - password must contain at least one special character i.e. !; @; #; $; %; etc.

4. Choose Change.

   a. The Password to the user’s account is being updated.

Show Login History#

If you want to check the login history of a specific user’s account, follow these steps:

1. Choose Tools → Users in Main toolbar.

2. Choose Show login history action for desired user.

   

   a. Choosing Show login history brings up Login history screen.

   

Delete User#

If you want to delete a specific user, follow these steps:

1. Choose Tools → Users in Main toolbar.

2. Choose Delete user(bin icon) action for user you wish to delete.

   

   a. After choosing Delete user action, confirmation pop-up will appear.

   

3. Choose Confirm.

   a. Specific User is being deleted from the environment - this user’s status changes to closed. This action is irreversible.

Grant allows using one or few functions in a Higson system, for example, authority to read a list of decision tables, change decision tables, etc… designers form these kinds of privileges available to users from the Higson team. Nevertheless, nothing stay on your way to set new grants.

In order to see Grants, select Tools → Users in Main Toolbar.

Then, select Grants tab.

After you enter Grants you will see screen of all Grants:

You can switch between Grants, Roles and Users screens by left-clicking on the desired Tab.