Each resource instance provides its own Edit Policies page, and you can access it through any of several navigational paths.

• For JNDI resources or WorkContext resources, see Access policies for JNDI resources or Access policies for Work Context resources.
• For other resource instances, a recommended path is:

1. In the left pane of the Console, select Security Realms.
2. On the Summary of Security Realms page, select the name of the realm that you want to secure the resource (for example, myrealm).
3. On the Settings page, select Roles and Policies > Policies.

   The Roles and Policies: Policies page organizes all of the domain's resources and corresponding policies in a hierarchical tree control.

4. On the Roles and Policies: Policies page, in the Policies table, expand the nodes in the Names column until you find the resource instance that you want to secure.

   For information on finding resources in the Names column, see Column Display.

5. Do one of the following:
   • If the Policy column for the resource instance contains a View Policy link, click the link. The presence of this link means that a policy has already been created for the resource instance. You can modify this policy to suit your needs.
   • If the Policies table does not already list a URL pattern that you want to secure, create a new URL pattern by selecting the name of the URL Patterns sub-node.
   • Otherwise, click the radio button next to the resource instance. Then click Create Policy.

   The Administration Console displays the resource's Edit Policies page.

Oracle recommends that you use the Role condition where possible. Basing conditions on security roles enables you to create one security policy that takes into account multiple users or groups, and is a more efficient method of management.

For more information, see Security Policy Conditions.

• If you selected Role, click Next, enter the name of a security role in the argument field, and click Add. To create a compound condition, enter another role name and click Add. A compound condition evaluates as true if either predicate is true. For example, if you create a compound condition that specifies the Operator and Deployer roles, then the condition is true if the user is in either role. If the security roles that you enter do not already exist, create them after you finish creating policies.
• If you selected Group or User, click Next , enter a name in the argument field, and click Add. To create a compound condition, enter another user or group name and click Add. If the users or groups that you name do not already exist, create them after you finish creating policies.
• If you selected a boolean predicate (Server is in development mode , Allow access to everyone, or Deny access to everyone), there are no arguments to enter. Click Finish and go to step 10.
• If you selected a context predicate, such as Context element's name equals a numeric constant, click Next and enter the context name and an appropriate value. It is your responsibility to ensure that the context name and/or value exists at runtime.
• If you selected a time-constrained predicate, such as Access occurs between specified hours, click Next and provide values for the Edit Arguments fields.

• Select And/Or between expressions to switch the and / or statements.
• Click Combine or Uncombine to merge or unmerge selected expressions. See Combine Conditions.
• Click Negate to make a condition negative; for example, NOT Group Operators excludes the Operators group from the role.