The access management system in Higson Studio is structured around three core components:
- Users
- Roles – Bundles of grants defining what a user can access and do.
- Grants – Specific rights that enable or restrict actions within the platform. Each user can be assigned one or more roles, and each role consists of a set of grants. This design allows for a secure, scalable, and flexible access model, supporting the principle of least privilege.
Below is a table outlining the available grants categorized by their function:
| # | Grant | Description |
|---|---|---|
| 1 | PROFILE_READ_<PROFILE_NAME> | Read-only access to a specific profile. |
| 2 | PROFILE_WRITE_<PROFILE_NAME> | Write access to a specific profile. |
| 3 | PROFILE_READ_ALL | Read access to all profiles and profile-related elements (domain, context, etc.). |
| 4 | PROFILE_WRITE_ALL | Write access to all profiles and profile-related elements (domain, context, etc.). |
| 5 | TAG_READ_<TAG_NAME> | Read access to elements marked with access control tag. |
| 6 | TAG_WRITE_<TAG_NAME> | Write access to elements marked with access control tag. |
| 7 | SNAPSHOT_DOWNLOAD | Permission to download snapshots. |
| 8 | SNAPSHOT_UPLOAD | Permission to upload snapshots. |
| 9 | RULE_ELEMENTS_READ | Read access to rule elements (functions, decision tables, flows), excluding those with tags. |
| 10 | RULE_ELEMENTS_WRITE | Write access to rule elements (functions, decision tables, flows), excluding those with tags. |
| 11 | RULE_ELEMENTS_READ_ALL | Read access to all rule elements (functions, decision tables, flows), including tagged ones. |
| 12 | RULE_ELEMENTS_WRITE_ALL | Write access to all rule elements (functions, decision tables, flows), including tagged ones. |
| 13 | SESSION_READ_ALL | Permission to read all sessions. |
| 14 | SESSION_WRITE_ALL | Permission to write all sessions. |
| 15 | SYSTEM_CONFIG_ACCESS | Permission to access and configure system-level settings. |
Default Roles in Higson Studio#
The system defines the following default roles:
| Role Name | Description | Grants Included |
|---|---|---|
| MPP_ADMIN | Full administrator access | RULE_ELEMENTS_WRITE_ALL, PROFILE_READ_ALL, SNAPSHOT_UPLOAD, PROFILE_WRITE_ALL, RULE_ELEMENTS_READ_ALL, SNAPSHOT_DOWNLOAD, SYSTEM_CONFIG_ACCESS, RULE_ELEMENTS_READ, RULE_ELEMENTS_WRITE, SESSION_READ_ALL, SESSION_WRITE_ALL, TESTER WRITE |
| MPP_SYSTEM_SCHEDULER | System scheduling access | TAG_WRITE_SYSTEM, TAG_READ_SYSTEM |
| MPP_USER | Full standard user access | SNAPSHOT_UPLOAD, SNAPSHOT_DOWNLOAD, RULE_ELEMENTS_READ, RULE_ELEMENTS_WRITE, TESTER WRITE |
| MPP_USER_READONLY | Read-only access to Hyperon Studio | PROFILE_READ_ALL, RULE_ELEMENTS_READ_ALL, RULE_ELEMENTS_READ |
Examples of Role Configurations#
Profile-Specific Role
When a new profile is created, two grants are generated:
- PROFILE_READ_<PROFILE_NAME>
- PROFILE_WRITE_<PROFILE_NAME>
To create a role that grants access only to global elements and the DEMO profile, assign the following grants:
- PROFILE_READ_DEMO
- PROFILE_WRITE_DEMO
- RULE_ELEMENTS_READ
- RULE_ELEMENTS_WRITE
Such a user:
- Will not have access to other profiles and their domain and context.
- Will see global elements and elements assigned to regions within the DEMO profile only.
Access-Control Tag Role
When a tag with access control is created (via Menu → Tools → Tags), the system generates grants:
- TAG_READ_<TAG_NAME>
- TAG_WRITE_<TAG_NAME>
These grants are listed under Tools → Users → Grants.
To grant access only to elements tagged with a specific tag:
- TAG_READ_<TAG_NAME>
- TAG_WRITE_<TAG_NAME>
To grant access to both tagged and global elements:
- TAG_READ_<TAG_NAME>
- TAG_WRITE_<TAG_NAME>
- RULE_ELEMENTS_READ
- RULE_ELEMENTS_WRITE
To grant access to all tagged and global elements:
- RULE_ELEMENTS_READ_ALL
- RULE_ELEMENTS_WRITE_ALL
Grant Codes Since Version 4.1#
| # | Grant code 4.0 | Grant code 4.1 | Description |
|---|---|---|---|
| 1 | PROD_R_<PROFILE_NAME> | PROFILE_READ_<PROFILE_NAME> | Read-only access to <PROFILE_NAME> profile details. |
| 2 | PROD_W_<PROFILE_NAME> | PROFILE_WRITE_<PROFILE_NAME> | Read-only access to <PROFILE_NAME> profile details. |
| 3 | PROD_R_ALL | PROFILE_READ_ALL | Read access to all profiles and profile-related elements (domain, context, rule elements attached to region). |
| 4 | PROD_W_ALL | PROFILE_WRITE_ALL | Modification access to all profiles and profile-related elements (domain, context, rule elements attached to region ). |
| 5 | PAR_R_CAT_<TAG_NAME> | TAG_READ_<TAG_NAME> | Read-only access to rule elements (decision tables, functions, flows) controlled by access control tag <TAG_NAME>. |
| 6 | PAR_W_CAT_<TAG_NAME> | TAG_WRITE_<TAG_NAME> | Modification access to rule elements (decision tables, functions, flows) controlled by access control tag <TAG_NAME>. |
| 7 | SNAPSHOT_DOWNLOAD | SNAPSHOT_DOWNLOAD | Download snapshot access. |
| 8 | SNAPSHOT_UPLOAD | SNAPSHOT_UPLOAD | Upload snapshot access. |
| 9 | PAR_R | RULE_ELEMENTS_READ | Read access to rule elements (decision tables, functions, flows), excluding rule elements with access control tags. |
| 10 | PAR_W | RULE_ELEMENTS_WRITE | Modification access to rule elements (decision tables, functions, flows), excluding rule elements with access control tags. |
| 11 | PAR_R_ALL | RULE_ELEMENTS_READ_ALL | Read access to rule elements (decision tables, functions, flows), including rule elements with access control tags. |
| 12 | PAR_W_ALL | RULE_ELEMENTS_WRITE_ALL | Modification access to rule elements (decision tables, functions, flows), including rule elements with access control tags. |
| 13 | SYSTEM_CONFIG_ACCESS | SYSTEM_CONFIG_ACCESS | System configuration access |
It is also important to note that only users with administrator privileges can create users, define roles, and assign grants to others.