Each user belongs to one or more groups. Each group specifies the functions that members of the group have access to (and may also specify functions that members of the group are denied access to).
You can define the permissions on a group by building them up from the permissions on other groups. This means you can create sub groups that give access to related functions, and list the appropriate sub groups on each "main" group. See Main Groups and Subgroups.
You can specify groups of functions, using wildcards, to provide a "broad brush" set of access permissions; you can then "fine tune" this by specifying additional functions to which the group has or does not have access.
Additionally, the MENUSEC parameter in COINS determines how access permissions are inherited. When MENUSEC is enabled (set to Y), granting access to a parent function automatically grants access to its child functions. This inheritance can cause certain functions to appear as "allowed" for a user, even if explicit access to those child functions has not been granted. To disable this inheritance, you can set the MENUSEC parameter to N, but note that this change affects the entire system and may not be suitable for all scenarios.
For example:
You might set up a group for people using Accounts Payable, allowing them access to all except the Maintenance, Administration and Set-up options. Everyone who belongs to this group would, by default, be able to access these options. You might have one user in the group who only needs to use the inquiries options, so you would restrict the individual access for that user. You might also have a supervisor, who needs access to the Maintenance, Administration and Set-up options, so you could extend the individual access for that user.
To explicitly deny access to specific functions for a group, you can use the "Deny Functions" field in the group maintenance screen. Enter the function code(s) you want to restrict (e.g., %WPO101ABPOHL) and save the changes. This ensures that users in the group cannot access these functions, even if they inherit permissions from a parent function.
Prime Groups
Each user is assigned to a prime group. In conjunction with the user's security level, this controls whether the user has access to reports and batches created by other users. You have access to another users' reports and batches if:
that user's prime group is included in your group list, and
your security level is higher than the other user's security level (or the security levels are equal, if the SY parameter EQUACESS is set to Y).
Because of this, we recommend that you have separate groups for data access (batches and reports) and for function access.
Best Practices for Managing Access Permissions
Regularly review group permissions to ensure they align with organizational policies.
Use the
MENUSECparameter judiciously to balance ease of management with security requirements.Document any changes to group-level denials for future reference and troubleshooting.