Access to VOB objects other than elements is primarily determined
by the object's owner and group.
In addition to elements and versions, a VOB contains other kinds
of objects that are subject to access control:
- Metadata types, such as label types, branch types, and attribute types
- Unified Change Management objects, such as projects, activities, and streams
- Storage pools
- Derived objects
In general, each of these objects has two properties that are important
for access control:
- Owner. The initial owner is the user of the process that creates
the object.
- Group. The initial group is the primary group of the process that
creates the object.
You can use the cleartool describe command
to display the owner and group of an object. After the object is created,
the object’s owner, the VOB owner, or a privileged user can use the cleartool protect command
to change the object’s owner or group. The group of the object must be one
of the VOB’s groups.
Permission to create other VOB objects
Any
user can create a type or a UCM object. Only the VOB owner or a privileged
user can create a storage pool.
Instances of types, such as labels,
branches, and attributes, are usually associated with element versions. To
create an instance of one of these types, one of the following conditions
must be true:
- The process has the user identity of the element’s owner.
- Any of the process’s group identities is the same as the element’s group.
- The process has the user identity of the VOB owner.
- The process has the user identity of a privileged user.
Permission to delete other VOB objects
The
owner of the object, the owner of the VOB, or a privileged user can delete
a type, a UCM object, or a storage pool.
Instances of types, such as
labels, branches, and attributes, are usually associated with element versions.
In general, if you can create an instance of a type, you can also delete the
instance. See Permission to create other VOB objects. In addition,
the creator of a branch instance can delete that instance.
Permission to read other VOB objects
Any
user can display information about a type, a UCM object, or a storage pool.
Permission to write other VOB objects
Any
user can change a UCM object. The owner of the object, the owner of the VOB,
or a privileged user can change a type or a storage pool.