Role Model

The role model configures security policies for different user groups and the current server.

What Is the Purpose of the Role Model?

The role model allows you to:

• prevent data leaks in advance
• simplify the process of imposing restrictions on employees and partners of the organization
• manage access to app features based on various attributes

Role Model General Settings

The Role model activated toggle allows you to enable or disable the role model on the server.

Below is a list of categories and rules created under them. For each rule, the following is displayed:

• Rule name
• Description
• Status (here you can activate or pause the rule)
• Rule properties
• edit, duplicate, and delete buttons

Role Model Setup Approach

To avoid difficulties when setting up the role model from the very beginning, configure it using the following steps:

1. Clearly define which specific action and which users need to be restricted using the role model.
2. Create, configure, and test a user group. A target user group is required for most role model rules.
3. Create and configure a rule suitable for your task.
4. ⚠️ For the rule to take effect, users will need to relaunch the app or reconnect to the network, or reopen a specific chat — depending on the type of rule.

Why Isn't the Role Model Working?

⚠️ Note that for role model to take effect, users will need to restart the client app or turn off and on the network connection on their devices.

For changes to apply in the Android app, you need to close it and wait about 2 minutes before relaunching it — modern Android operating systems may not terminate the app immediately.

⚠️ Also the role model temporarily not supported in the Aurora app.

Besides Restrictions, What Else Will Stop Working If the Role Model Is Disabled?

When the role model is not active, the availability settings for Smart Apps to user groups also stop working.

Role Model and CDTN Contour Settings

All role model settings (both user groups and rules) involving external/internal contours use the internal contour IP mask value specified in the Contour group under the File Service section.

How Do the Role Model and CDTN Rules Interact?

When configuring the role model for file-related restrictions, keep in mind that they may overlap with rules configured for the Corporate Data Transmission Network (CDTN) contour:

• if a file action is restricted in the role model but not in the CDTN settings — the role model will restrict the action;
• if a file action is restricted in the CDTN settings but not in the role model — the CDTN will restrict the action.

Thus, simultaneously enabled CDTN contour and role model restrictions are cumulative.

Can the Contour Be Used Only in the Role Model?

To use the contour in the role model without CDTN contour restrictions:

1. Enable the CDTN contour in the File Service section, set any in all settings fields, and enter the list of IPs/masks for the internal contour. The role model will use the specified internal contour.
2. In the role model user group settings, select Internal contour to apply rules to users inside the specified CDTN contour or External contour to apply rules to users outside the CDTN contour.
3. Create a role model rule targeting this user group.

In the future, the CDTN contour settings are planned to be fully moved to the role model section.