Authorization Restrictions

MMG provides two types of self-authorization restrictions: user-level and group-level. These controls prevent users from authorizing changes that they have created and help organizations enforce the maker-checker principle and proper segregation of duties.

Configure these parameters in the NEXTGENEMF_CONFIG table in the MMG Configuration Schema. The supported values are Y and N. The default value for both parameters is Y

Note:

After changing either parameter, restart the MMG application/services for the changes to take effect.

User-Level Self Authorization Restriction

Table 11-23 Configuration of User-Level Self Authorization Restriction

Parameter Description Default
IS_SELF_USER_AUTH_ALLOWED Controls whether a user can authorize requests that were created by the same user. Y
Behavior
  • Y:
    • Users can authorize requests that they created, provided they have the required authorization privileges and the group-level restriction permits the authorization..
    • Standard authorization workflow is followed.
  • N:
    • Users cannot authorize requests that they created.
    • The application prevents authorization of self-created requests.
    • Another authorized user must complete the authorization.

Example

User Alice creates a Model Promotion request.
  • If IS_SELF_USER_AUTH_ALLOWED=Y, Alice can authorize the request, provided she has the required authorization privileges and the group-level restriction permits the authorization.
  • If IS_SELF_USER_AUTH_ALLOWED=N, Alice cannot authorize the request. Another authorized user, such as Bob, must complete the authorization..

Group-Level Self Authorization Restriction

Table 11-24 Configuration of Group-Level Self Authorization Restriction

Parameter Description Default
IS_SELF_USR_GRP_AUTH_ALLOWED Controls whether users belonging to the same user group as the request creator can authorize the request. Y

Behavior

  • Y
    • Members of the request creator’s user group can authorize the request, provided they have the required authorization privileges.
    • The request creator remains subject to the IS_SELF_USER_AUTH_ALLOWED parameter.
  • N
    • Members of the request creator’s user group cannot authorize the request.
    • An authorized user belonging to a different user group must complete the authorization.
Example
  • Alice belongs to Group A.
  • Bob belongs to Group A.
  • Charlie belongs to Group B.
    Alice creates a request:

    Table 11-25 Behavior of Group-Level Self Authorization Restriction

    Configuration Who can authorize?
    IS_SELF_USR_GRP_AUTH_ALLOWED=Y Bob or Charlie, provided they have the required authorization privileges. Alice’s ability to authorize the request depends on IS_SELF_USER_AUTH_ALLOWED.
    IS_SELF_USR_GRP_AUTH_ALLOWED=N Charlie or another authorized user belonging to a different user group.