Role Model

The role model configures security policies for user groups and the current server.

What Is the Purpose of the Role Model?

The role model allows you to:

• prevent data leaks in advance
• simplify restrictions for the organization's employees and partners
• manage access to app features based on various attributes

Role Model General Settings

The Role model activated toggle enables and disables the role model on the server.

Next is the list of categories and the rules in each of them. For each rule, the following are displayed:

• Rule name
• Description
• Status: here you can activate or pause the rule
• Rule properties
• edit, duplicate, and delete buttons

Role Model Setup Approach

To avoid difficulties at the beginning, configure the role model step by step:

1. Define which action the role model should prohibit and for which users.
2. Create, configure, and test a user group. A target user group is required for most role model rules.
3. Create and configure a rule suitable for your task.
4. ⚠️ For the rule to take effect, users need to sign in to the app again, reconnect to the network, or reopen a specific chat. What exactly to do depends on the rule type.

Why Isn't the Role Model Working?

⚠️ The role model takes effect when users restart the app or turn the network off and on again on their devices.

For the changes to take effect in the Android app, you need to end the app and wait about 2 minutes before launching it again. New versions of Android may not unload the app immediately.

⚠️ The Aurora app doesn't yet support the role model.

Besides Restrictions, What Else Will Stop Working If the Role Model Is Disabled?

When the role model is not active, the availability settings for Smart Apps to user groups also stop working.

Role Model and CDTN Contour Settings

All role model user groups and rules with an external or internal contour take the internal contour IP mask from the Contour group in the File Service section.

How Do the Role Model and CDTN Rules Interact?

In addition to role model restrictions on actions with files, rules of the Corporate Data Transmission Network (CDTN) contour may apply:

Role Model	CDTN	Who will prohibit an action with a file
Prohibits	Does not prohibit	Role Model
Does not prohibit	Prohibits	CDTN

Simultaneously enabled CDTN contour and role model restrictions are cumulative.

Can the Contour Be Used Only in the Role Model?

To use the contour in the role model without CDTN contour restrictions:

1. Enable the CDTN contour in the File Service section, set any in all settings fields, and enter the list of IPs/masks for the internal contour. The role model will use the specified internal contour.
2. In the user group settings of the role model, select a contour. The Internal loop value applies the rules to users inside the specified CDTN contour, External loop — to users outside the CDTN contour.
3. Create a role model rule targeting this user group.

The CDTN contour settings are planned to be fully moved to the role model section.