/configure-access-rights

To configure access rights in Directum RX, you map roles to entity types using DefaultAccessRightsTypes and grant per-instance permissions at runtime. You must also align AccessRightsMode in entity metadata to Both so the platform enforces type and instance authorization simultaneously.

AccessRightsMode in Directum RX entity metadata controls whether the platform enforces authorization on a Type level, an Instance level, or Both. Setting this value correctly in your .mtd files ensures the platform applies the intended permission grants.

To set up idempotent roles during Directum RX module initialization, define stable role GUIDs once in ModuleConstants and create localized roles within the ModuleInitializer. This ensures role creation runs consistently without duplicating entries on subsequent executions.

Yes, you can use ComputedRoles in Directum RX to dynamically assign access rights based on entity data. This allows you to produce authorization recipients contextually, such as assigning experts to a specific contract, enabling dynamic CRM security policies.

You apply leading-entity inheritance in Directum RX by using EntitySecureLinks to connect child objects to their parent. This configuration ensures child entities reuse the parent’s authorization scope, maintaining consistent access rights across linked records.

Per-type grants in Directum RX fail to enforce authorization when AccessRightsMode in the entity metadata is not aligned with your intended model. You must explicitly set AccessRightsMode to Type, Instance, or Both in your .mtd files to match your Grant and Save flows.