Scope

A Table Right or Column Right with Scope = "Foreground and background" gives the holder foreground access on that table or column.

Foreground access includes background access. It consists of all types of access to data, for example:

•Access through (fields in) info windows and web forms based on the table or column.

•Access to tables and columns by calling USoft Batch jobs that access the table or column.

•Access to tables and columns by calling USoft REST service methods that access the table or column.

A Table Right or Column Right with Scope = "Background only" gives the holder only background access on that table or column.

Background access consists only of:

•Data access by a constraint,

•Data access by a relationship attribute,

both as an indirect result of some foreground access initiated by the holder. The Delete Rule and Update Rule relationship attributes require SELECT background access if set to "Restricted" and UPDATE background access if set to "Cascading" or "Nullify".

Scope = "Background only" allows you to hide a table or column fully from a user, while at the same time allowing constraints and relationships to manipulate that table or column on behalf of the user.

It only makes sense to give a holder "Background only" scope on a table or column B if that holder has some foreground access to some table or column A that indirectly requires access to B.

A Table Right or Column Right with Scope = None denies the holder that access right.

Scope = None is never strictly needed to express Table Rights, since a holder is already denied every right that is not specified in the first place. There are 2 use cases for specifying Scope = None explicitly:

•For Column Rights, specify rights with Scope = None in order to restrict a wider Table Right by overriding (denying) that right for a specific column.

•For Table Rights, depending on your project preferences, you may decide (as a standard) to have a Table Right record for each usergroup for each table. This approach could make it easier to trace and control that a given Table Right is granted or denied. If you use this strategy, set Scope = None for Table Rights that are denied.