Control Access to Contracts Using Access Groups

You can now use access groups to control access to contract records. Access groups are an alternative way of granting data permissions to users. After creating an access group and assigning users to it, all group members receive access to contract data based on the object sharing rules defined for the group. These rules determine which contracts users can see and the type of access provided, such as Read or Full access. Using access groups is mandatory for accessing contracts through the Redwood Contracts UI. Access groups can also be used for contracts classic UI. 

Access groups can supplement existing data security policies. When both access groups and data security policies are configured, users receive the combined visibility granted by both mechanisms. If you want only the access provided by the access group to take effect, you must remove the visibility granted through existing data security policies, such as policies based on contract ownership or team membership. Access groups work alongside functional security: they determine which contract records a user can access, while job roles continue to govern the actions the user can perform on those records.

Access groups also offer several advantages over custom data security policies. They provide better performance, support more flexible attribute-based access, and are significantly easier to manage. Records granted through access group membership can also be searched and filtered in Workspace, whereas records granted only through custom data security policies cannot. Because of these benefits, access groups are the recommended mechanism for controlling access to contract data, especially when adopting the Redwood Contracts UI.

System Access Groups for Contracts

The following system access groups are created for predefined contract-related roles. Users are added or removed from these groups automatically based on job role assignment.

  • Customer Contract Administrator Group
  • Customer Contract Manager Group
  • Customer Contract Team Member Group
  • Enterprise Contract Administrator Group
  • Enterprise Contract Manager Group
  • Enterprise Contract Team Member Group
  • Supplier Contract Administrator Group
  • Supplier Contract Manager Group
  • Supplier Contract Team Member Group

These groups appear under Access Groups with Type = System Group and cannot be modified.

System Groups

System Groups

Predefined Object Sharing Rules for Contracts

The following predefined rules are available for the Contract object. These rules are automatically associated with the appropriate system access groups and cannot be modified.

General Access Rules

  • All Contracts

Contract Owner Based Rules

  • Contract Owner Read Access
  • Contract Owner Full Access

Sales Contract Rules
Business Unit Based

  • Sales Contract by Business Unit

Resource Based

  • Sales Contract Read Access by Resource
  • Sales Contract Full Access by Resource

Resource Ancestor Based

  • Sales Contract Read Access by Resource Ancestors
  • Sales Contract Full Access by Resource Ancestors

Resource Organization Manager / Member / Ancestor / Descendant Based

  • Sales Contract Read Access by Resource Organization Manager
  • Sales Contract Read Access by Ancestor Resource Organization Manager
  • Sales Contract Read Access by Resource Organization Member
  • Sales Contract Read Access by Descendant Resource Organization
  • Sales Contract Full Access by Resource Organization Manager
  • Sales Contract Full Access by Ancestor Resource Organization Manager
  • Sales Contract Full Access by Resource Organization Member
  • Sales Contract Full Access by Descendant Resource Organization

Procurement Contract Rules
Business Unit Based

  • Procurement Contract by Business Unit

Resource Based

  • Procurement Contract Read Access by Resource
  • Procurement Contract Full Access by Resource

Resource Ancestor Based

  • Procurement Contract Read Access by Resource Ancestors
  • Procurement Contract Full Access by Resource Ancestors

Resource Organization Manager / Member / Ancestor / Descendant Based

  • Procurement Contract Read Access by Resource Organization Manager
  • Procurement Contract Read Access by Ancestor Resource Organization Manager
  • Procurement Contract Read Access by Resource Organization Member
  • Procurement Contract Read Access by Descendant Resource Organization
  • Procurement Contract Full Access by Resource Organization Manager
  • Procurement Contract Full Access by Ancestor Resource Organization Manager
  • Procurement Contract Full Access by Resource Organization Member
  • Procurement Contract Full Access by Descendant Resource Organization

Contract's Predefined Object Sharing Rules

Contract's Predefined Object Sharing Rules

Editing Predefined Object Sharing Rule

Editing Predefined Object Sharing Rule

Defining Custom Contract Access Rules

You can configure custom contract access rules using a wide range of contract attributes. These attributes allow you to precisely control which contract records an access group can see or act on, based on business criteria.

Common attributes available for rule definition include:

  • Business Unit
  • Contract Status
  • Intent
  • Contract Type
  • Contract Class
  • Legal Entity
  • Version Type
  • Template Flag
  • Contract Number
  • Contract ID
  • Created Date
  • Amount
  • Hold Reason
  • All Extensible Attributes
  • All Descriptive Flexfields

Once a custom rule is defined, one or more access groups can be assigned to it with the appropriate level of access - Read or Full.
You can also reference predefined system rules as predefined conditions when creating a custom contract access rule.

Custom Rule Creation

Custom Rule Creation

After modifying access groups or object sharing rules for Contracts, you must run the required ESS jobs from all four tabs under the Monitor section to ensure the changes are applied. These include the processes from:

  1. Update Groups and Members
    • Run when user or role assignments change.
  2. Publish Rules
    • Run when object sharing rules or rule assignments are modified.
  3. Synchronize Custom Objects and Fields
    • Run when custom objects, attributes are updated
  4. Perform Object Sharing Rule Assignment (Contract Object)
    • Run to populate object sharing assignments

Running all applicable ESS jobs ensures that access group membership, rule conditions, and contract visibility are fully synchronized across the application.

For more details, refer to the official Access Groups Oracle documentation: https://docs.oracle.com/en/cloud/saas/sales/fasac/overview-of-access-groups.html

Monitor Tab to run ESS jobs

Monitor Tab to run ESS jobs

Access Groups for contracts provide a flexible and business-friendly way to control who can see on contract list page, without relying on complex data security policies.

Steps to Enable and Configure

To enable or extend access using an existing predefined rule:

  1. Navigate to Tools > Sales and Service Access Management > Object Rules.
  2. Select Contract from Object drop-down.
  3. Open a predefined rule such as All Contracts.
  4. Click Add under Assign Access Group.
  5. Select the desired group (e.g. Enterprise Contract Manager Group) and set Read or Full access.
  6. Save and Publish Rules.

To create a new custom sharing rule:

  1. Click Create under Object Rules.
  2. Enter rule name and description.
  3. Define the rule condition
  4. Select Read / Full Access.
  5. Assign one or more access groups.
  6. Save and Publish Rules.

To process and apply the above predefined or custom rules:

  1. Go to the Monitor tab.
  2. Run the required ESS jobs from all four subtabs as applicable:
    1. Update Groups and Members
    2. Publish Rules
    3. Synchronize Custom Objects and Fields
    4. Perform Object Sharing Rule Assignment (Contract Object)
  3. If required, schedule these processes to run at regular intervals to support near real-time access updates.

Tips And Considerations

Using access groups is mandatory for accessing contracts through the Redwood Contracts UI. Access groups supplement the data access that users already receive through contract job roles, contract team membership, or existing data security policies. If you want only access-group-based visibility to apply, you need to remove any existing data security policies. Otherwise, users may continue to see contract records through both access mechanisms. Access groups control which contract records a user can see, they do not grant functional privileges.

Key Resources

For more details, refer to the official Access Groups Oracle documentation: https://docs.oracle.com/en/cloud/saas/sales/fasac/overview-of-access-groups.html

Access Requirements

To verify and use access groups and object sharing rules for contracts, users must have access to the contract list page enabled through the Redwood Contract Management feature. Enable the following opt-in:

  • Search for and enable: Redwood Contract Management
    (Opt-in code: ORA_OKC_ENABLE_REDWOOD_MANAGE_CONTRACTS)

In addition to access groups–based data visibility, users must also be assigned the appropriate functional privileges through their job roles to view or edit contracts.

For more details on Sales and Service Access Management, refer to the official Access Groups Oracle documentation:
https://docs.oracle.com/en/cloud/saas/sales/fasac/overview-of-access-groups.html