Security: CRUD operations

Epicor ERP 10
1

I am trying to figure out the best (easiest, too) way to implement security based on CRUD access.There is menu security, service security, field security, extended properties, context menu maintenance and customizations.

It was recently discovered that one of our sales reps (let’s call her “Mary”) used Job Manager to figure out availability of inventory. She used the context menu of the part number to launch Job Manager.

A request has come down from on high to limit access to Job Manager. I know that I can simply remove it from the context menus, but we don’t mind if she sees it, we just don’t want her to touch it…

So… it seems to me there are the following options:

  1. Remove Job Manager from the context menu. Unfortunately, this would remove it for people who are allowed to access it.

  2. Menu security. Prevent Mary from navigating to Job Manager. This is already in place.

  3. Service security. Can prevent Mary from accessing Job manager altogether, but this seems like overkill, if all we are worried about is an errant change.

  4. Field-level options seem too low-level for what we would like to do.

A few questions:

  1. If we were to secure via Service Security, but did not secure the menu, would Mary still have access? Or would she see the menu item but get an error when she clicked it? Bad user experience but good security.

  2. Is there relatively easy way to make a service / business object read-only for a specific set of users?

  3. If we have made a service read-only , I assume I can use field-level security to open up one or two fields which are editable by a user or users?

Best practices, anyone, for replicating security based on typical CRUD operations?

Thanks.

–sam

2

If implemented properly, tbis should have prevented her from accessing it.

In Context maintenance, you can see the menu item that the right click will launch. Set the security on that menu item.

I believe that you have to do it on the menu item, and that doing it to the parent menu isnt enough.

3

When you create a menu, there is a [Read Only] checkbox, I beleive this is how some of the simplere tracker screens are implemented.

Regards,
Jon

4

Have you looked at Process Security? In our environment we have process security on Part whereas we allow some most users that have access to Part Maintenance
make changes to a Part but we only allow a couple security groups to create new parts and part revisions.

Scott