AccessGroupsEnable lets you enable one or more model-defined access groups at runtime so that the corresponding protected data and user-interface elements are available to the appropriate users.

Overview

An access group is a security group defined in the model. This operator enables access groups during runtime and thereby controls who can see or modify data and UI elements protected by those groups.

AccessGroupsEnable is an MDriven-specific operator; it is not part of standard OCL. For general OCL operator guidance, see Documentation:OCL General Operators.

Use it for runtime access control

Use AccessGroupsEnable when access must depend on the active runtime situation rather than being fixed for every user session.

For example, an organization has an access group named Managers:

• Sensitive information on Department is protected for managers.
• A user who belongs to the Managers access group must have that group enabled at runtime.
• When the group is enabled, the protected Department data and UI elements are available according to the access-group protection defined in the model.

This makes the access rule explicit: membership in Managers grants access to the Department features protected for managers.

Implementation workflow

1. Define the required access group in the model, for example Managers.
2. Protect the relevant Department data and UI elements with that access group.
3. Use AccessGroupsEnable at the runtime point where the applicable access groups must be enabled.
4. Test with a user who belongs to Managers and with a user who does not. Verify both the protected data and protected UI behavior.

Verify ViewModel access

Access groups affect protected runtime features. When you need to check whether an object can access a particular ViewModel, use canAccess. The canAccess operator evaluates access to a supplied ViewModel using that ViewModel's Access Expression settings.

For example, self.canAccess(User.ViewModels.UserSettings) checks whether self can access the UserSettings ViewModel. The ViewModels operator is used in that example so that a ViewModel rename can be detected in MDriven Designer.

Important

• Do not treat AccessGroupsEnable as standard OCL. It is an MDriven operator.
• The access group name and the protection applied to data or UI elements must match the model's security design.
• Test both allowed and denied cases. A manager scenario is incomplete until you have also confirmed that a non-manager cannot access the protected Department features.

See also

• Documentation:OCLOperators canAccess
• Documentation:OCL General Operators
• Documentation:OCL Boolean Operators