Set the application scope, application resource, and event access
Create a record in the Restricted Caller Access Privileges [sys_restricted_caller_access] table to set cross-scope resource access requests. Approve or deny requests from a source scope or source scope application resources to a target scope or to target scope application resources.
Before you begin
If you enable application administration for the target application, only application administrators of the target application can set access to an application. If application administration is not enabled, an admin user can set access to an application.
Role required: application admin or admin
Note: To learn about application-specific administrator roles and delegated development, see Access control rules in application administration apps and Delegated development and deployment.
About this task
You can set the following restricted caller access privilege settings combinations:
- Scope-to-Scope
- Scope-to-Target
- Source-to-Scope
- Source-to-Target
Note: An RCA privilege record must be present in the target application to grant access to a resource. This means that the target scope must match the application scope.
Procedure
Navigate to All > System Applications > Application Restricted Caller Access.
On the form, fill in the fields.
| Field | Description |
|---|---|
| Operation | Operation performed on the target resource.- Read - Write - Create - Delete - Execute API |
| Source | Cross-scope record that is accessing a restricted application resource. |
| Source Scope | Scope of the calling application. |
| Source Table | Table that contains the Source record. |
| Source Type | Type of record that is calling the application resource:- ACL - Business Rule - Document Title - Flow - Flow Action - GlideScopedEvaluator - Inbound Email Script - Orchestration RunScript Activity - Record Producer Script - Service Portal Widget - Scheduled Script - Scope - Script Include - UI Action - UI Macro - UI Page - Workflow Activity For example, to allow access from an entire application, select Scope. |
| Status | Status of the access request:- Requested - Denied - Allowed - Invalidated Note: If a calling resource changes, the restricted caller access record status changes to Invalidated. If you enable application administration, only application administrators of the target application can update the status of a request. |
| Target | Record of the requested resource. |
| Target Scope | Scope of the requested resource. |
| Target Table | Table that contains the Target record. |
| Target Type | Type of requested resource.- Event Note: An event is a special type of target for restricted caller access. By selecting an event in a target scope, you give a source application permission to queue an event that is registered as part of a target application. However, if you set the caller access on the event registry to None, it prevents cross-scope access calls to an event. This setting combination is a one-to-one relationship. To learn more about events, and their function, see Events. If you set caller access to None on the event registry, the cross-scope access calls to an event are denied.
|
- Scope-to-scope settings
Allow or deny access of all application resources in a source scope to all application resources in a target scope. This setting combination is a many-to-many relationship. - Scope-to-target settings
Allow or deny access of all application resources in a source scope to a specific application resource (business rule, table, script include, or event) in a target scope. - Source-to-scope settings
Allow or deny access of a specific application resource in a source scope to all application resources in a target scope. - Source-to-target settings
Allow or deny access of a specific application resource in a source scope to a specific application resource in a target scope.
Parent Topic:Restricted caller access privilege settings