Permission Levels

Permission Levels

When Model Manager authorizes a database action that targets item versions on a branch, it consults up to three levels of protection — the repository that the items belong to, the branch the item versions belong to, and, possibly, the items themselves. An analogous level consultation is done for item versions recorded by a snapshot.

Permission Combinations for Branches

The necessary permission combinations for possible database actions that target item versions on a branch are summarized as follows:

Table 2-8: Necessary permission combinations for performing possible database actions that target items on a branch.
Action	Repository	Branch	Item
Browse and search item versions	See repository	See branch	N/A
Open a model in the COMSOL Desktop	See repository	See branch	Open model
Download data files	See repository	See branch	Download file
Create a new item	Save in repository	Save in branch	N/A
Assign tags to items	Save in repository	Save in branch	N/A
Save a new model version	Save in repository	Save in branch	Save model
Save a new file version	Save in repository	Save in branch	Save file
Save a new tag version	Save in repository	Save in branch	Save tag
Delete a model	Save in repository	Save in branch	Delete model
Delete a file	Save in repository	Save in branch	Delete file
Delete a tag	Save in repository	Save in branch	Delete tag


	An important takeaway from Table 2-8 is that if you grant a See repository permission and a See branch permission to users, they will be able to see settings of all models and files with versions on the branch via, for example, The Model Manager Window, The Databases Window, or the The Versions Window. If some models contain sensitive information exposed through, for example, the Contents section in the Model Settings, you must restrict access to the repository or branch to protect it. Limiting who can open an individual model should not be relied upon to keep its inner workings secret.

You may wonder why access to models and data files cannot be controlled via their assigned tags? After all, tags have many similarities with folders on the file system, and access to files on the file system can typically be controlled via folder permissions. The motivation is twofold:

•

Models and files can have several tags, that is, they can appear in multiple places in The Tag Tree.

•

Tag assignments are version controlled via commits — see Adding and Removing Tag Assignments.

This makes it hard to reason about the access granted to a model or file. An item could perhaps be protected under one tag’s permissions but exposed under another tag’s. An item could be protected under a tag at the present time, but older versions may be exposed in the commit history if the item was previously tagged by another tag with less restrictive permissions.

Permission Combinations for Snapshots

The necessary permission combinations for possible database actions that target the item versions recorded by a snapshot are summarized as follows (there are no database actions that save to the database):

Table 2-9: Necessary permission combinations for performing possible database actions that target the item version recorded by a snapshot.
Action	Repository	Snapshot	Item
Browse and search item versions	See repository	See snapshot	N/A
Open a model in the COMSOL Desktop	See repository	See snapshot	Open model
Download data files	See repository	See snapshot	Download file

The Permission Requirements Dialog Box

Model Manager performs a preemptive authorization check whenever you open a window or dialog box that is intended for saving to the database. If the check fails, a link button (

) whose button text summarizes why the check failed is shown.

Click the link button to open a dialog box with the necessary permission requirements shown in a table. Select the check box to only see permission requirements that you lack.