Invantive Estate protects data with two mechanisms that work together: project security and function security. ## The Combination A user sees data in a function only if the user has access to the data and to the function. A user can change data in a function only if the user has write access to the project and write access to the function. A user can therefore change data in one screen and not in another. There is no security for data that does not belong to a project. For that data, access to the function decides whether someone can see or change it. The user `system` always has access to all projects and functions. ## Project Security Per project it is set whether someone may see all data of that project, or change it. All data means the project itself and everything under it, such as invoice lines, orders, revenues and the project authorisations. The rights can be set at four places: - in the settings, to let everyone see or change all projects; - on a role, to let all users of the role see or change all projects. The role also has indicators for seeing all documents, all process notes and all anniversaries; - per project and user, with a project authorisation. The authorisation can allow editing. It can also be added implicitly when a person is assigned to the project; - through profile options with `-pae-` in the code, which give a controller automatic read or edit rights to the projects the controller is responsible for. ## Function Security A function is a screen or a report that a user can request. Per function it is set whether a role may open it and whether it may change data in it. The rights are granted per role. The rights are granted in the matrix of role authorisations and in the matrix of user roles. See [[Authorisation Matrices]]. ## Documents Documents follow the combination of project and function security. In addition, access to each kind of document has its own function, so that an organisation can decide who sees which kind of documents. See [[Invantive Estate/Concepts/Documents|Documents]]. ## Users and Roles A user is a person with a user name. Roles describe a function in the organisation, such as project developer or controller. Roles are assigned to users, and rights to roles. The demonstration database holds several example roles for administration, application manager, guest, project manager, timekeeper and director. ## See Also - [[Invantive Estate/Concepts/Organisations and Persons|Organisations and Persons]] - [[Invantive Studio/Users and Rights|Users and Rights in Invantive Studio]]