A Oracle Content Services Roles

Table A-1

Administrative Role	Permissions	Applicable to Domain (D), Container (C), or Workspace (W)			Propagating?
CategoryAdministrator	Discover, AdministerCategory	D			false
ConfigurationAdministrator	Discover, AdministerConfiguration	D	C	W	true
ContainerAdministrator	Discover, AdministerContainer, CreateContainer	D	C		true
ContentAdministrator	Discover, AddItem, AddVersion, Copy, CreateFolder, Delete, GetContent, GetMetadata, Lock, Move, SetAttribute, SetContent, SetMetadata	D	C	W	true
DomainAdministrator	Discover, AdministerDomain	D			false
QuotaAdministrator	Discover, AdministerQuota	D	C		true
RecordsAdministrator	Discover, AdministerRecord	D			false
RoleAdministrator	Discover, AdministerRole	D			false
SecurityAdministrator	Discover, AdministerSecurity	D	C	W	true
UserAdministrator	Discover, AdministerUser	D			false
WorkspaceAdministrator	Discover, AdministerWorkspace, CreateWorkspace	D	C	W	true

Table A-2

Standard (Non-Administrative) Role	Permissions	Applicable to Domain (D), Container (C), or Workspace (W)			Propagating?
Administrative Assistant	Discover, AddItem, AdministerConfiguration, AdministerSecurity, CreateFolder			W	false
Administrator	Discover, AddItem, AddVersion, AdministerConfiguration, AdministerSecurity, AdministerWorkspace, Copy, CreateFolder, Delete, GetContent, GetMetadata, Lock, Move, SetAttribute, SetContent, SetMetadata			W	true
Approver	Discover, Copy, GetContent, GetMetadata, Lock, SetAttribute, SetContent, SetMetadata			W	false
Author	Discover, AddItem, AddVersion, Copy, CreateFolder, Delete, GetContent, GetMetadata, Lock, Move, SetAttribute, SetContent, SetMetadata			W	false
Commentator	Discover, Copy, GetContent, GetMetadata, Lock, SetAttribute, SetContent, SetMetadata			W	false
ContainerViewer	Discover	D	C		false
ContentEditor	Discover, AddItem, AddVersion, Copy, CreateFolder, GetContent, GetMetadata, Lock, SetAttribute, SetContent, SetMetadata			W	false
Custodian	Discover, AddItem, AddVersion, Copy, CreateFolder, GetContent, GetMetadata, Lock, SetAttribute, SetContent, SetMetadata			W	false
Discoverer	Discover			W	false
LimitedAuthor	Discover, AddItem, AddVersion, Copy, CreateFolder, GetContent, GetMetadata, Lock, SetAttribute, SetContent, SetMetadata			W	false
Manager	AdministerSecurity, CreateFolder			W	false
None	NONE				false
Organizer	Discover, Copy, Delete, GetMetadata, Lock, Move, SetAttribute, SetMetadata			W	false
Participant	Discover, AddItem, AddVersion, Copy, CreateFolder, Delete, GetContent, GetMetadata, Lock, Move, SetAttribute, SetContent, SetMetadata			W	false
Reader	Discover, Copy, GetContent, GetMetadata			W	false
Reviewer	Discover, Copy, GetContent, GetMetadata			W	false
WorkspaceCreator	Discover, CreateWorkspace	D	C		true

Table A-3 FDK Constants for defined Roles

Role	FdkConstant
CategoryAdministrator	ECM_ROLEKEY_CATEGORYADMIN
ConfigurationAdministrator	ECM_ROLEKEY_CONFIGURATIONADMIN
ContainerAdministrator	ECM_ROLEKEY_CONTAINERADMIN
ContentAdministrator	ECM_ROLEKEY_CONTENTADMIN
DomainAdministrator	ECM_ROLEKEY_DOMAINADMIN
QuotaAdministrator	ECM_ROLEKEY_QUOTAADMIN
RecordsAdministrator	ECM_ROLEKEY_RECORDSADMIN
RoleAdministrator	ECM_ROLEKEY_ROLEADMIN
SecurityAdministrator	ECM_ROLEKEY_SECURITYADMIN
UserAdministrator	ECM_ROLEKEY_USERADMIN
WorkspaceAdministrator	ECM_ROLEKEY_WORKSPACEADMIN
ContainerViewer	ECM_ROLEKEY_CONTAINERVIEWER
WorkspaceCreator	ECM_ROLEKEY_WORKSPACECREATOR
Administrator	ECM_ROLEKEY_ADMIN

Table A-4 Permissions for Oracle Content Services roles

Permission	Description	FDK Constant
AddItem	Add an item to a folder (by create, or move operation)	CAPABILITY_ADDITEM
AddVersion	Add a new version to a version controlled document item	CAPABILITY_ADDVERSION
AdministerConfiguration	Create, modify, or delete configuration categories on an item (with the exception of SecurityConfiguration and QuotaConfiguration)	CAPABILITY_ADMINISTER_CONFIGURATION
AdministerContainer	Modify or delete a container. Permission is required on the parent item of the container being modified or deleted.	CAPABILITY_ADMINISTER_CONTAINER
AdministerCategory	Create, modify, or delete a category class object	CAPABILITY_ADMINISTER_CATEGORY
AdministerDomain	Modify a domain's properties	CAPABILITY_ADMINISTER_DOMAIN
AdministerQuota	Modify the quota configuration of a workspace item	CAPABILITY_ADMINISTER_QUOTA
AdministerRecord	Create, modify, or delete a record file plan. Also allows user to remove "record" status from an existing record item and perform other records management administration.	CAPABILITY_ADMINISTER_RECORD
AdministerRole	Create, modify, or delete a custom role	CAPABILITY_ADMINISTER_ROLE
AdministerSecurity	Create, modify, or delete security configuration of an item	CAPABILITY_ADMINISTER_SECURITY
AdministerUser	Modify or delete a domain's users and groups. Additionally, enables user to get and set user preferences including domain defaults.	CAPABILITY_ADMINISTER_USER
AdministerWorkspace	Modify or delete a workspace	CAPABILITY_ADMINISTER_WORKSPACE
Copy	Copy an item	CAPABILITY_COPY
CreateContainer	Create a container	CAPABILITY_CREATECONTAINER
CreateFolder	Create a folder	CAPABILITY_CREATEFOLDER
CreateWorkspace	Create a workspace (not needed for creation of a personal workspace)	CAPABILITY_CREATEWORKSPACE
Delete	Delete an item	CAPABILITY_DELETE
Discover	Discover an item and view its basic metadata (such as name, description, and creation date). Permission is implicit if the user is granted any other permission on the item.	CAPABILITY_DISCOVER
GetContent	Get the content of a document item	CAPABILITY_GET_CONTENT
GetMetadata	Get the metadata (category information) of an item	CAPABILITY_GETMETADATA
Lock	Lock a document item	CAPABILITY_LOCK
Move	Move an item. Requires AddItem permission on the destination folder.	CAPABILITY_MOVE
SetAttribute	Set basic attributes of an item (description). Permission is required to rename Document, Folder, Family, and Link items. For link items, this permission also allows users to change the object referenced by the link.	CAPABILITY_SET_ATTR
SetContent	Set the content of a non-version-controlled document item	CAPABILITY_SET_CONTENT
SetMetadata	Set the metadata (create, modify, or delete category information) of an item	CAPABILITY_SETMETADATA

Notes on permission types:

• Within a single grant, the same Role may not appear more than once

• Within a single grant, the "NONE" Role may not be combined with any other role

• If the grantee belongs to the "World" group, the Domain must be enabled for world group grants.

• The SetAttribute permission is required to rename a Document, Folder, Family, or Link.

• The AdministerWorkspace permission is required to rename a Workspace.

• The AdministerContainer permission is required to rename a Container.

• The System Admin privileges are required to rename a Domain.

• The SecurityAdministrator role is the most powerful; users granted this role can grant themselves or anybody else all available access.

• To delete a Container, a user must have the AdministerContainer permission on the parent of the container being deleted.

• When deleting a Container, all recursively contained sub-containers and sub-workspaces are also deleted. The user must have permission to delete the sub-containers according to the rule stated above. The user must also have AdministerWorkspace permission on all of the sub-workspaces that are to be deleted. If the user does not have these required permissions, the originating container delete will fail with an ACCESS_DENIED exception. Containers that are deleted are permanently deleted; deleted workspaces have the workspace's contents moved to the archive.