Role Model Rules

Is It Possible to Grant Permissions to Users in the Role Model?

No. All role model rules are prohibitive only. In the role model, you configure what a specific user or user group is prohibited from doing. In the CDTN contour, in the File Service section, it is the other way around: there you configure what is allowed.

How Is the Attachment Type Determined?

Client Version	Description
Before 3.71	When viewing or saving, the app determines the type of all attachments by their extension and downloads them as an image, video, or document. Therefore, the restriction on downloading or saving documents applies only to document extensions.
3.71 and later	When the role model is enabled, the app determines the file type and extension by its content instead of the extension in its name. If the file has been renamed, the app recognizes its actual format, and the restriction applies in the same way as for the original format: both when sending and when forwarding. If the actual type cannot be determined, the app falls back to the previous method — by the extension in the file name. The file is checked on the user's device. The server does not parse file contents. The Document attachment type also covers non-office formats: in the list of restricted extensions, you can specify, for example, exe or zip.

Creating a Role Model Rule

To create a new rule, click Create a new rule and configure it.

Rule Configuration Fields

Field	Description
Rule name	At the administrator’s discretion. Specify a unique name that reflects the essence of the prohibition.
Rule description	This field is optional, but it's worth filling in.
User groups	Mandatory field. Select a group created in advance in the “User Groups” section.
Scope	Where the rule applies: Messaging — in chats, channels, and discussions in the app In Smartapp — in SmartApps in the app
Rule action	Mandatory field. Select the action type: Forwarding/sharing/saving attachments to device memory is not allowed Recipients are not allowed to download attachments from cts users Downloading/viewing attachments is not allowed Sending/forwarding attachments is not allowed Require pin Forbid clipboard usage in application Forbid screenshot creation The list of rule types will be expanded.
Attachment Type	Mandatory field for file-related rules. Select the attachment type: Image Video Document Multiple types cannot be selected. Create a separate rule for each type if necessary.

When you create a rule, activate it.

Restriction Target, Global and Local Rules for Chats

Global & Local Rules

Rule Type	Global	Local
Description	Applies to all user chats.	Applies to specific user chats based on specified attributes.
Attributes	When the fields chat participant type and chat type in the Prohibition function group are empty — the rule applies globally. A global rule can be created without attributes by filling only the fields Rule name, User Groups, Rule Type, and Attachment type. In such a rule, attachments from any users, of any size, and with any extension will be prohibited.	The rule becomes local when at least one field is filled in the Prohibition function group: chat participant type (Select users whose presence in the chat disallows an action) chat type (Select the type of chat for which the prohibition is configured) In addition to chat attributes, local rules can include the fields size (Enter the maximum allowable file size (MB)), extension (Enter the type of prohibited extensions separated by a comma (e.g. pdf, pptx)), or sender (Select users whose attachments are subject to prohibition).
Exception chats Field	Unavailable.	Available when a field is filled in the Prohibition function group. You can add no more than 100 chats.
When Applies	The server sends the rule to the client when logging into the app and when reconnecting to the server. For the rule to take effect, the user needs to restart the app or reconnect to the network.	The server sends the rule to the client when entering a specific chat, channel, or thread. For the rule to take effect, the user needs to navigate to the specific chat, channel, or thread.

Attributes Fields

The list of fields in the restriction target depends on the selected attachment type and the rule itself.

By default, if an attribute field is not filled, the attribute has the value “all”. For example:

• If the extension and size of attachments are not specified, a prohibition is created for the selected attachment type with all its extensions and sizes. For example, a restriction on sending any documents to a chat.
• If chat type (Select the type of chat for which the prohibition is configured) or chat participant type (Select users whose presence in the chat disallows an action) is not specified, the prohibition applies to all user chats and channels
• If sender (Select users whose attachments are subject to prohibition) is not specified, the prohibition applies to attachments received from any user

The type of forbidden extensions is checked only for documents: images and video are not checked by extension. A video larger than 50 MB is sent as a document, so its extension is checked.

Attribute Combinations

Attachment attributes: sender, size, extension. Chat attributes: chat participant type, chat type.

If chat attributes are not specified, rules for attachment attributes apply globally. If chat attributes are specified, rules apply only in the specified chats.

How multiple attributes are combined:

Server Version	Combination
Pre 3.46	Attributes do not depend on each other; the logical “OR” rule applies between them.
3.46 and above	Attributes are combined using “AND”: the restriction will only trigger if all assigned conditions are met simultaneously. ⚠️ After updating to 3.46, migration will occur: old rules with multiple attributes will be split into smaller rules with a single attribute after migration.

• Prior to version 3.46,
• Starting from version 3.46,

Examples from an actual version (3.46 and above):

• If for the Documents attachment type you specified size = no more than 30 MB, and in the extension type field — pdf, pptx, a rule with two attributes is created. The attributes work together: actions with pdf and pptx documents larger than 30 MB are prohibited.
• When both Chat participant type and Chat type are filled, the rule applies to a chat that matches the value of both the Chat participant type field AND the Chat type field.
• If for the attachment type Documents , you specified size = no more than 30 MB and selected a chat type, the action will be prohibited in chats of this type. The prohibition applies to all documents larger than 30 MB with any extension.

What Happens If Multiple Restrictions Are Configured for a Single User Group?

Several different restrictions for the same user group are cumulative and apply simultaneously because role model rules work only as prohibitions.

Rules for SmartApps

Role model rules can be configured both for messenger chats and for SmartApps.

What Can Be Restricted in SmartApps?

Prohibitions for SmartApps apply only to actions with attachments in them. The role model cannot be used to control actions with the content itself, for example, forwarding an email in the Email SmartApp.

For example, the restriction for sending/forwarding attachments for SmartApps prevents the user from uploading and sending attachments. But the user will be able to forward a received email with an attachment, because when forwarding, the Email SmartApp uses existing attachments uploaded by another user. With any prohibition in place, the user can forward an email with attachments or reply to it.

Configuring Rules for Attachments in SmartApps

In a SmartApp rule, you can specify:

• application to all SmartApps (with the option to specify exceptions)
• application to specific SmartApps

Attachments in SmartApps can be restricted entirely or by file size/extension. SmartApps handle attachments differently on platforms:

Client platform	Description
Web/Desktop	In SmartApps in web/desktop apps, the attachment type cannot be selected when sending — photos and videos are sent only as photos or videos; they cannot be sent as documents.
Android, iOS	In SmartApps in mobile apps, the attachment type can be specified when sending. Prohibitions trigger based on the attachment type in the rule and the selected type when sending. For example, if sending all documents is prohibited in the mobile app, photos or videos cannot be sent as documents.

Rules for SmartApps Chat Bots

Role model rules for SmartApps also apply in chats with their bots:

• in a 1-on-1 chat with a SmartApp bot, only SmartApp rules apply
• in a 1-on-1 chat with a regular bot (not a SmartApp), global or local rules for chats apply
• in group chats and channels with any bot, global or local rules for chats apply

Searching and Checking Role Model Rules by User

To find and check rules, use the search field at the top of the page.

Rules that apply to a user can be found only by the user's HUID.

You can search by name, connection type, platform, and status. The name is entered in the top search field.

“Sending/forwarding attachments in chats is not allowed” Rule

This rule can apply to both the messenger and Smart App. The rule fields and their effect are described below.

Select users whose presence in the chat prohibits an action

Not applicable to Smart Apps, only applies to the messenger.

Type	Results
Images	Parameter Action All except users from trusted servers If the chat contains users from an untrusted corporate or public server, you won't be able to choose the Image option when you click the paperclip button. In such a chat, the send button will be inactive after dragging an image. All except users from own server If the chat contains users from any server other than the current one, when you click the paperclip button, you won't be able to choose the Image option. In such a chat, the send button will be inactive after dragging an image. Specific user If this specific user is present in the chat, when you click the paperclip button, you will not be able to choose the Image option. In such a chat, the send button will be inactive after dragging an image. Public users and guests If there are users from a public server or guests in the chat, when you click the paperclip button, you cannot choose the Image option. In such a chat, the send button will be inactive after dragging an image. The chat will display “This chat has restrictions on sending images” or “Forwarding images is restricted” when the prohibition is triggered for a user in the group.
Videos	⚠️ Video larger than 50 MB is sent as a document. Parameter Action All except users from trusted servers If the chat contains users from an untrusted corporate or public server, when you click the paperclip button, you will not be able to choose the Video option. In such a chat, the send button will be inactive after dragging a video. All except users from own server If the chat contains users from any server other than the current one, clicking the paperclip button will not let you choose the Video option. In such a chat, the send button will be inactive after dragging a video. Specific user If this specific user is present in the chat, when you click the paperclip button, you won’t be able to choose the Video option. In such a chat, the send button will be inactive after dragging a video. Public users and guests If users from a public server or guests are present in the chat, when you click the paperclip button, you won't be able to choose the Video option. In such a chat, the send button will be inactive after dragging a video. The chat will display “This chat has restrictions on sending videos” or “Forwarding videos is restricted” when the prohibition is triggered for a user in the group.
Documents	Parameter Action All except users from trusted servers If the chat contains users from an untrusted corporate or public server, when you click the paperclip button, you won't be able to choose the Document option. In such a chat, the send button will be inactive after dragging a document. All except users from own server If users from any server other than the current one are present in the chat, you can't choose the Document option when you click the paperclip button. In such a chat, the send button will be inactive after dragging a document. Specific user If this specific user is present in the chat, you can't select the Document option when you click the paperclip button. In such a chat, the send button will be inactive after dragging a document. Public users and guests If there are users from a public server or guests in the chat, when you click the paperclip button, you won't be able to choose the Document option. In such a chat, the send button will be inactive after dragging a document. The chat will display “This chat has restrictions on sending documents” or “Forwarding documents is restricted” when the prohibition is triggered for a user in the group.

Select the chat type to be restricted

Not applicable to Smart Apps, only applies to the messenger.

Type	Results
Images	Parameter Action Select a chat Only in this chat, you won't be able to choose the Image option by clicking the paperclip button. In the same chat, the send button will also be inactive after dragging an image into the chat. Only group chats and channels without end-to-end encryption Only in group chats and channels without end-to-end encryption enabled, when you click the paperclip button, you won't be able to choose the Image option. In them, too, the send button will be inactive after dragging an image into the chat. Only group chats and channels with end-to-end encryption Only in group chats and channels with end-to-end encryption enabled, when you click the paperclip button, you won't be able to choose the Image option. In them, too, the send button will be inactive after dragging an image into the chat. Only personal chats In 1-1 personal chats only, when you click the paperclip button, you won't be able to choose the Image option. In them, the send button will also be inactive after dragging an image into the chat. The chat will display “This chat has restrictions on sending images” or “Forwarding images is restricted” when the prohibition is triggered for a user in the group.
Videos	⚠️ Note that videos are sent as documents if their size exceeds 50 MB! Parameter Action Select a chat Only in this chat, when you click the paperclip button, you won't be able to choose the Video option. In the same chat, the send button will be inactive after dragging a video into the chat. Only group chats and channels without end-to-end encryption Only in group chats and channels without end-to-end encryption enabled, you won't be able to choose the Video option when you click the paperclip button. In them, the send button will be inactive after dragging a video into the chat. Only group chats and channels with end-to-end encryption Only in group chats and channels with end-to-end encryption enabled, when you click the paperclip button, you won't be able to choose the Video option. In them as well, the send button will be inactive after dragging a video into the chat. Only personal chats Only in personal 1-1 chats, when you click the paperclip button, you will not be able to choose the Video option. In them, the send button will also be inactive after dragging a video into the chat. The chat will display “This chat has restrictions on sending videos” or “Forwarding videos is restricted” when the prohibition is triggered for a user in the group.
Documents	Parameter Action Select a chat Only in this chat, when you click the paperclip button, you won't be able to select the Document option. In the same chat, the send button will be inactive after dragging a document into the chat. Only group chats and channels without end-to-end encryption Only in group chats and channels without end-to-end encryption enabled, when you click the paperclip button, you won't be able to choose the Document option. In them, the send button will also be inactive after dragging a document into the chat. Only group chats and channels with end-to-end encryption Only in group chats and channels with end-to-end encryption enabled, when you click the paperclip button, you won't be able to choose the Document option. In them as well, the send button will be inactive after dragging a document into the chat. Only personal chats Only in personal 1-1 chats, when you click the paperclip button, you won't be able to choose the Document option. In them as well, the send button will be inactive after dragging a document into the chat. The chat will display “This chat has restrictions on sending documents” or “Forwarding documents is restricted” when the prohibition is triggered for a user in the group.

Enter server IDs to which you want to prohibit sending attachments

Sending attachments to the server IDs specified here will be prohibited. You can specify a CTS ID (regular corporate server), ECTS ID (corporate server under ETS), RTS ID (public server).

Apply in all SmartApps/Apply in specific SmartApps

Not applicable to the messenger, only applies to Smart Apps and personal chats with their bots.

Type	Results
Images	In all or specific Smart Apps and in personal chats with their bots, a user in the group will not be able to attach and send an image. When attempting to send or forward an image, the user in the group will see “This chat has restrictions on sending” in the bot chat or “Sending images is restricted” in the Smart App.
Videos	⚠️ Note that videos are sent as documents if their size exceeds 50 MB! In all or specific Smart Apps and in personal chats with their bots, a user in the group will not be able to attach and send a video. When attempting to send or forward a video, the user in the group will see “This chat has restrictions on sending” in the bot chat or “Sending videos is restricted” in the Smart App.
Documents	In all or specific Smart Apps and in personal chats with their bots, a user in the group will not be able to attach and send a document. When attempting to send or forward a document, the user in the group will see “This chat has restrictions on sending” in the bot chat or “Sending documents is restricted” in the Smart App.

Enter the maximum file size

Applies to both the messenger and Smart Apps, including personal chats with Smart App bots.

Type	Results
Images	When attempting to send an image larger than the specified size, the send button will be inactive for the user in the group, and “Sending images over N MB is restricted” will appear below the image. When attempting to send or forward an image larger than the specified size, the user in the group will see “Forwarding images is restricted.”
Videos	⚠️ Note that videos are sent as documents if their size exceeds 50 MB! When attempting to send a video larger than the specified size, the send button will be inactive for the user in the group, and “Sending videos over N MB is restricted” will appear below the video (up to 50 MB). When attempting to send or forward a video larger than the specified size, the user in the group will see “Forwarding videos is restricted.”
Documents	When attempting to send a document larger than the specified size, the send button will be inactive for the user in the group, and “Sending documents over N MB is restricted” will appear below the document. When attempting to send or forward a document larger than the specified size, the user in the group will see “Forwarding documents is restricted.”

Enter the type of restricted extentions

Applies to both the messenger and Smart Apps (including personal chats with Smart App bots).

Type	Results
Images	Not applicable to images.
Videos	⚠️ Note that videos are sent as documents if their size exceeds 50 MB! Not applicable to videos.
Documents	When attempting to send a document with a prohibited extension, the send button will be inactive for the user in the group, and “Sending N documents is restricted” will appear below the document. When attempting to send or forward a document with a prohibited extension, the user in the group will see “Forwarding documents is restricted.”

Exception chats/Exception smartapps

The rule does not apply to the selected chats or Smart Apps. Exception chats can be selected only when creating a local rule, that is, when a field is filled in the Prohibition function group. Exception Smart Apps can be selected when the rule applies to all Smart Apps.

“Downloading/viewing attachments is not allowed” Rule

This rule can apply to both the messenger and Smart App. The rule fields and their action are described below.

This rule includes the “Forwarding/sharing/saving attachments to device memory is not allowed” rule, because it prevents downloading a file from the server.

Select users whose presence in the chat prohibits the action

Not applicable to Smart Apps, only applies to the messenger.

Type	Results
Images	Parameter Action All except users from trusted servers If the chat includes users from non-trusted corporate or public servers, the user from the group will not be able to view the image. All except users from own server If the chat includes users from any other server except the current one, the user from the group will not be able to view the image. Specific user If this specific user is present in the chat, the user from the group will not be able to view the image. Public users and guests If the chat includes users from public servers or guests, the user from the group will not be able to view the image. The chat will display “This chat has restrictions on viewing attachments” or “Viewing images is restricted” when the prohibition is triggered for the user from the group.
Videos	⚠️ Video over 50 MB is sent as a document. Parameter Action All except users from trusted servers If the chat includes users from non-trusted corporate or public servers, the user from the group will not be able to view the video. All except users from own server If the chat includes users from any other server except the current one, the user from the group will not be able to view the video. Specific user If this specific user is present in the chat, the user from the group will not be able to view the video. Public users and guests If the chat includes users from public servers or guests, the user from the group will not be able to view the video. The chat will display “This chat has restrictions on viewing attachments” or “Viewing videos is restricted” when the prohibition is triggered for the user from the group.
Documents	Parameter Action All except users from trusted servers If the chat includes users from non-trusted corporate or public servers, the user from the group will not be able to view the document. All except users from own server If the chat includes users from any other server except the current one, the user from the group will not be able to view the document. Specific user If this specific user is present in the chat, the user from the group will not be able to view the document. Public users and guests If the chat includes users from public servers or guests, the user from the group will not be able to view the document. The chat will display “This chat has restrictions on viewing attachments” or “Viewing documents is restricted” when the prohibition is triggered for the user from the group.

Select the chat type to be restricted

Not applicable to Smart Apps, only applies to the messenger.

Type	Results
Images	Parameter Action Select a chat Only in this chat, the user from the group will not be able to view the image. Only group chats and channels without end-to-end encryption Only in group chats and channels without enabled end-to-end encryption, the user from the group will not be able to view the image. Only group chats and channels with end-to-end encryption Only in group chats and channels with enabled end-to-end encryption, the user from the group will not be able to view the image. Only personal chats Only in personal 1-1 chats, the user from the group will not be able to view the image. The chat will display “This chat has restrictions on viewing attachments” or “Viewing images is restricted” when the prohibition is triggered for the user from the group.
Videos	⚠️ Note that videos are sent as documents if their size exceeds 50 MB! Parameter Action Select a chat Only in this chat, the user from the group will not be able to view the video. Only group chats and channels without end-to-end encryption Only in group chats and channels without enabled end-to-end encryption, the user from the group will not be able to view the video. Only group chats and channels with end-to-end encryption Only in group chats and channels with enabled end-to-end encryption, the user from the group will not be able to view the video. Only personal chats Only in personal 1-1 chats, the user from the group will not be able to view the video. The chat will display “This chat has restrictions on viewing attachments” or “Viewing videos is restricted” when the prohibition is triggered for the user from the group.
Documents	Parameter Action Select a chat Only in this chat, the user from the group will not be able to view the document. Only group chats and channels without end-to-end encryption Only in group chats and channels without enabled end-to-end encryption, the user from the group will not be able to view the document. Only group chats and channels with end-to-end encryption Only in group chats and channels with enabled end-to-end encryption, the user from the group will not be able to view the document. Only personal chats Only in personal 1-1 chats, the user from the group will not be able to view the document. The chat will display “This chat has restrictions on viewing attachments” or “Viewing documents is restricted” when the prohibition is triggered for the user from the group.

Select users whose attachments are restricted

This field works the same way as the Corporate users can read rule in the File Service > Contour section. This happens if a user group from the internal contour of the Corporate Data Transfer Network (CDTN) is selected as the group.

Not applicable to Smart Apps, only applies to the messenger.

Type	Results
Images	Parameter Action All except internal loop users This rule applies if the user from the group is inside CDTN. A user in the CDTN contour will not be able to view the image from users outside the CDTN contour. Everyone except external users This rule applies if the user from the group is outside CDTN. The user from the group, located outside the CDTN contour, will not be able to view the image from users inside the CDTN contour. All except users from trusted servers The user from the group will not be able to view the image from users on non-trusted or public servers. All except users from own server The user from the group will not be able to view the image from users on any other server. Specific user The user from the group will not be able to view the image from the specified user. Public users and guests The user from the group will not be able to view the image from public users and guests. The chat will display “This chat has restrictions on viewing attachments” or “Viewing images is restricted” when the prohibition is triggered for the user from the group.
Videos	⚠️ Note that videos are sent as documents if their size exceeds 50 MB! Parameter Action All except internal loop users This rule applies if the user from the group is in CDTN. A user in the CDTN contour will not be able to view the video from users outside the CDTN contour. Everyone except external users This rule applies if the user from the group is outside CDTN. The user from the group, located outside the CDTN contour, will not be able to view the video from users inside the CDTN contour. All except users from trusted servers The user from the group will not be able to view the video from users on non-trusted or public servers. All except users from own server The user from the group will not be able to view the video from users on any other server. Specific user The user from the group will not be able to view the video from the specified user. Public users and guests The user from the group will not be able to view the video from public users and guests. The chat will display “This chat has restrictions on viewing attachments” or “Viewing videos is restricted” when the prohibition is triggered for the user from the group.
Documents	Parameter Action All except internal loop users This rule applies if the user from the group is in CDTN. A user in the CDTN contour will not be able to view the document from users outside the CDTN contour. Everyone except external users This rule applies if the user from the group is outside CDTN. The user from the group, located outside the CDTN contour, will not be able to view the document from users inside the CDTN contour. All except users from trusted servers The user from the group will not be able to view the document from users on non-trusted or public servers. All except users from own server The user from the group will not be able to view the document from users on any other server. Specific user The user from the group will not be able to view the document from the specified user. Public users and guests The user from the group will not be able to view the document from public users and guests. The chat will display “This chat has restrictions on viewing attachments” or “Viewing documents is restricted” when the prohibition is triggered for the user from the group.

Apply in all SmartApps/Apply in specific SmartApps

Not applicable to the messenger, only applies to Smart Apps and personal chats with their bots.

Type	Results
Images	In all or specific Smart Apps and in personal chats with their bots, the user from the group will not be able to view or download the image. When attempting to view or download the image, the user from the group will see “This chat has restrictions on viewing” in the chat with the bot or “Viewing images is restricted” in the Smart App.
Videos	⚠️ Note that videos are sent as documents if their size exceeds 50 MB! In all or specific Smart Apps and in personal chats with their bots, the user from the group will not be able to view or download the video. When attempting to view or download the video, the user from the group will see “This chat has restrictions on viewing” in the chat with the bot or “Viewing videos is restricted” in the Smart App.
Documents	In all or specific Smart Apps and in personal chats with their bots, the user from the group will not be able to view or download the document. When attempting to view or download the document, the user from the group will see “This chat has restrictions on viewing” in the chat with the bot or “Viewing documents is restricted” in the Smart App.

Enter the maximum file size

Applies to both the messenger and Smart Apps, including personal chats with Smart App bots.

Type	Results
Images	A received image larger than the specified size cannot be viewed or downloaded, even if the user sent it themselves. The chat will display “This chat has restrictions on viewing attachments.”
Videos	⚠️ Note that videos are sent as documents if their size exceeds 50 MB! A received video that is larger than the specified size cannot be viewed or downloaded, even if the user sent it themselves. The chat will display “This chat has restrictions on viewing attachments.”
Documents	A received document larger than the specified size cannot be viewed or downloaded, even if the user sent it themselves. The chat will display “This chat has restrictions on viewing attachments.”

Enter the type of restricted extentions

Applies to both the messenger and Smart Apps (including personal chats with Smart App bots).

Type	Results
Images	Not applicable to images.
Videos	⚠️ Note that videos are sent as documents if their size exceeds 50 MB! Not applicable to videos.
Documents	A received document with a prohibited extension cannot be viewed, even if the user sent it themselves. The chat will display “This chat has restrictions on viewing attachments” or “Viewing N documents is restricted.”

Exception chats/Exception smartapps

The rule does not apply to the selected chats or Smart Apps. Exception chats can be selected only when creating a local rule, that is, when a field is filled in the Prohibition function group. Exception Smart Apps can be selected when the rule applies to all Smart Apps.

“Forwarding/sharing/saving attachments to device memory is not allowed” Rule

This rule can apply to both the messenger and Smart App. The rule fields and their action are described below.

Disable forwarding of messages with attachments in the app — a setting available since version 3.49. With it, the rule prohibits forwarding attachments both to other applications and within the application itself.

Select users whose presence in the chat prohibits the action

Not applicable to Smart Apps, only to the messenger.

Type	Results
Images	Parameter Action All except users from trusted servers If the chat includes users from non-trusted corporate or public servers, the user from the group will not be able to forward, share, or save the image to device memory. All except users from own server If the chat includes users from any other server except the current one, the user from the group will not be able to forward, share, or save the image to device memory. Specific user If this specific user is present in the chat, the user from the group will not be able to forward, share, or save the image to device memory. Public users and guests If the chat includes users from public servers or guests, the user from the group will not be able to forward, share, or save the image to device memory. The chat will display “Forwarding images is restricted” when the prohibition is triggered for the user from the group.
Videos	⚠️ Video larger than 50 MB is sent as a document. Parameter Action All except users from trusted servers If the chat includes users from non-trusted corporate or public servers, the user from the group will not be able to forward, share, or save the video to device memory. All except users from own server If the chat includes users from any other server except the current one, the user from the group will not be able to forward, share, or save the video to device memory. Specific user If this specific user is present in the chat, the user from the group will not be able to forward, share, or save the video to device memory. Public users and guests If the chat includes users from public servers or guests, the user from the group will not be able to forward, share, or save the video to device memory. The chat will display “Forwarding videos is restricted” when the prohibition is triggered for the user from the group.
Documents	Parameter Action All except users from trusted servers If the chat includes users from non-trusted corporate or public servers, the user from the group will not be able to forward, share, or save the document to device memory. Printing the document in the web or desktop app (View > Ctrl(Cmd)+P) outputs empty pages. All except users from own server If the chat includes users from any other server except the current one, the user from the group will not be able to forward, share, or save the document to device memory. Printing the document in the web or desktop app (View > Ctrl(Cmd)+P) outputs empty pages. Specific user If this specific user is present in the chat, the user from the group will not be able to forward, share, or save the document to device memory. Printing the document in the web or desktop app (View > Ctrl(Cmd)+P) outputs empty pages. Public users and guests If the chat includes users from public servers or guests, the user from the group will not be able to forward, share, or save the document to device memory. Printing the document in the web or desktop app (View > Ctrl(Cmd)+P) outputs empty pages. The chat will display “Forwarding documents is restricted” when the prohibition is triggered for the user from the group.

Select the chat type to be restricted

Not applicable to Smart Apps, only to the messenger.

Type	Results
Images	Parameter Action Select a chat Only in this chat will the user from the group be unable to forward, share, or save the image to device memory. Only group chats and channels without end-to-end encryption Only in group chats and channels without enabled end-to-end encryption will the user from the group be unable to forward, share, or save the image to device memory. Only group chats and channels with end-to-end encryption Only in group chats and channels with enabled end-to-end encryption will the user from the group be unable to forward, share, or save the image to device memory. Only personal chats Only in 1-1 personal chats will the user from the group be unable to forward, share, or save the image to device memory. The chat will display “Forwarding images is restricted” when the prohibition is triggered for the user from the group.
Videos	⚠️ Note that videos are sent as documents if their size exceeds 50 MB! Parameter Action Select a chat Only in this chat will the user from the group be unable to forward, share, or save the video to device memory. Only group chats and channels without end-to-end encryption Only in group chats and channels without enabled end-to-end encryption will the user from the group be unable to forward, share, or save the video to device memory. Only group chats and channels with end-to-end encryption Only in group chats and channels with enabled end-to-end encryption will the user from the group be unable to forward, share, or save the video to device memory. Only personal chats Only in 1-1 personal chats will the user from the group be unable to forward, share, or save the video to device memory. The chat will display “Forwarding videos is restricted” when the prohibition is triggered for the user from the group.
Documents	Parameter Action Select a chat Only in this chat will the user from the group be unable to forward, share, or save the document to device memory. Printing the document in the web or desktop app (View > Ctrl(Cmd)+P) outputs empty pages. Only group chats and channels without end-to-end encryption Only in group chats and channels without enabled end-to-end encryption will the user from the group be unable to forward, share, or save the document to device memory. Printing the document in the web or desktop app (View > Ctrl(Cmd)+P) outputs empty pages. Only group chats and channels with end-to-end encryption Only in group chats and channels with enabled end-to-end encryption will the user from the group be unable to forward, share, or save the document to device memory. Printing the document in the web or desktop app (View > Ctrl(Cmd)+P) outputs empty pages. Only personal chats Only in 1-1 personal chats will the user from the group be unable to forward, share, or save the document to device memory. Printing the document in the web or desktop app (View > Ctrl(Cmd)+P) outputs empty pages. The chat will display “Forwarding documents is restricted” when the prohibition is triggered for the user from the group.

Select users whose attachments are restricted

This field works similarly to the Corporate users can read rule in the File Service > Contour section.

Not applicable to Smart Apps, only to the messenger.

Type	Results
Images	Parameter Action All except internal loop users This rule applies if the user from the group is inside CDTN. The user from the group, located in the CDTN contour, will not be able to forward, share, or save the image from users outside the CDTN contour to device memory. Everyone except external users This rule applies if the user from the group is outside CDTN. The user from the group, located outside the CDTN contour, will not be able to forward, share, or save the image from users inside the CDTN contour to device memory. All except users from trusted servers The user from the group will not be able to forward, share, or save the image from users on non-trusted or public servers to device memory. All except users from own server The user from the group will not be able to forward, share, or save the image from users on any other server to device memory. Specific user The user from the group will not be able to forward, share, or save the image from the specified user to device memory. Public users and guests The user from the group will not be able to forward, share, or save the image from public users and guests to device memory. The chat will display “Forwarding images is restricted” when the prohibition is triggered for the user from the group.
Videos	⚠️ Note that videos are sent as documents if their size exceeds 50 MB! Parameter Action All except internal loop users This rule applies if the user from the group is inside CDTN. The user from the group, located in the CDTN contour, will not be able to forward, share, or save the video from users outside the CDTN contour to device memory. Everyone except external users This rule applies if the user from the group is outside CDTN. The user from the group, located outside the CDTN contour, will not be able to forward, share, or save the video from users inside the CDTN contour to device memory. All except users from trusted servers The user from the group will not be able to forward, share, or save the video from users on non-trusted or public servers to device memory. All except users from own server The user from the group will not be able to forward, share, or save the video from users on any other server to device memory. Specific user The user from the group will not be able to forward, share, or save the video from the specified user to device memory. Public users and guests The user from the group will not be able to forward, share, or save the video from public users and guests to device memory. The chat will display “Forwarding videos is restricted” when the prohibition is triggered for the user from the group.
Documents	Parameter Action All except internal loop users This rule applies if the user from the group is inside CDTN. The user from the group, located in the CDTN contour, will not be able to forward, share, or save the document from users outside the CDTN contour to device memory. Printing the document in the web or desktop app (View > Ctrl(Cmd)+P) outputs empty pages. Everyone except external users This rule applies if the user from the group is outside CDTN. The user from the group, located outside the CDTN contour, will not be able to forward, share, or save the document from users inside the CDTN contour to device memory. Printing the document in the web or desktop app (View > Ctrl(Cmd)+P) outputs empty pages. All except users from trusted servers The user from the group will not be able to forward, share, or save the document from users on non-trusted or public servers to device memory. Printing the document in the web or desktop app (View > Ctrl(Cmd)+P) outputs empty pages. All except users from own server The user from the group will not be able to forward, share, or save the document from users on any other server to device memory. Printing the document in the web or desktop app (View > Ctrl(Cmd)+P) outputs empty pages. Specific user The user from the group will not be able to forward, share, or save the document from the specified user to device memory. Printing the document in the web or desktop app (View > Ctrl(Cmd)+P) outputs empty pages. Public users and guests The user from the group will not be able to forward, share, or save the document from public users and guests to device memory. Printing the document in the web or desktop app (View > Ctrl(Cmd)+P) outputs empty pages. The chat will display “Forwarding documents is restricted” when the prohibition is triggered for the user from the group.

Apply in all SmartApps/Apply in specific SmartApps

Not applicable to the messenger, only to Smart Apps and personal chats with their bots.

Type	Results
Images	In all or specific Smart Apps and in personal chats with their bots, the user from the group will not be able to forward, share, or save the image to device memory. When attempting to forward, share, or save the image to device memory, the user from the group will see “Forwarding images is restricted” in the chat with the bot or “Downloading images is restricted.”
Videos	⚠️ Note that videos are sent as documents if their size exceeds 50 MB! In all or specific Smart Apps and in personal chats with their bots, the user from the group will not be able to forward, share, or save the video to device memory. When attempting to forward, share, or save the video to device memory, the user from the group will see “Forwarding videos is restricted” in the chat with the bot or “Downloading videos is restricted.”
Documents	In all or specific Smart Apps and in personal chats with their bots, the user from the group will not be able to forward, share, or save the document to device memory. Printing the document in the web or desktop app (View > Ctrl(Cmd)+P) outputs empty pages. When attempting to forward, share, or save the document to device memory, the user from the group will see “Forwarding documents is restricted” in the chat with the bot or “Downloading documents is restricted.”

Enter the maximum file size

Applies to both the messenger and Smart Apps, including personal chats with Smart App bots.

Type	Results
Images	The user from the group will not be able to forward, share, or save the image larger than the specified size to device memory. The chat will display “Forwarding images larger than N MB is restricted” when the prohibition is triggered for the user from the group.
Videos	⚠️ Note that videos are sent as documents if their size exceeds 50 MB! The user from the group will not be able to forward, share, or save the video larger than the specified size to device memory. The chat will display “Forwarding videos larger than N MB is restricted” when the prohibition is triggered for the user from the group.
Documents	The user from the group will not be able to forward, share, or save the document larger than the specified size to device memory. Printing the document in the web or desktop app (View > Ctrl(Cmd)+P) outputs empty pages. The chat will display “Forwarding documents larger than N MB is restricted” when the prohibition is triggered for the user from the group.

Enter the type of restricted extentions

Applicable to both the messenger and Smart Apps (including personal chats with Smart App bots).

Type	Result
Images	Not applicable to images.
Videos	⚠️ Note that videos are sent as documents if their size exceeds 50 MB! Not applicable to videos.
Documents	A received document with a prohibited extension cannot be forwarded, shared, or saved to device memory, even if the user sent it themselves. Printing the document in the web or desktop app (View > Ctrl(Cmd)+P) outputs empty pages. The chat will display “Forwarding N documents is restricted” when the prohibition is triggered for the user from the group.

Exception chats/Exception smartapps

The rule does not apply to the selected chats or Smart Apps. Exception chats can be selected only when creating a local rule, that is, when a field is filled in the Prohibition function group. Exception Smart Apps can be selected when the rule applies to all Smart Apps.

“Recipients are not allowed to download attachments from cts users”

This rule applies only within the messenger. This prohibition is analogous to the Corporate files can read setting in the File Service > Contour section. There is one difference: this prohibition also divides contour users:

• internal contour — a user in the CDTN contour from the same server;
• trusted contour — a user in the CDTN contour from a trusted server.

Sender and Recipient

In this prohibition:

• The sender is a user from the group for which this rule is configured. The receiving prohibition applies to attachments sent by a user of this group
• the recipient is a user who meets the criteria specified in the rule.

Mandatory Rule Fields

To create a rule, fill in at least one of the fields:

• Select loop restriction
• Select users for whom the action will not be allowed

⚠️ If both fields are filled, the stricter restriction will apply.

Instant Action of the Restriction

An enabled restriction applies to an attachment immediately after sending: you don't need to restart the client or reconnect to the network. Attachments sent before the prohibition is enabled are not covered by it. After the restriction is turned off, it continues to apply only to attachments sent while it was on.

Contour and Role Model Rules Comparison

A contour-based prohibition and a role model prohibition on receiving are triggered differently in this situation. On the recipient's server, in the File Service section, Contour is disabled, but the contour IP mask is filled in. A contour user receives an attachment that can only be seen in the contour:

• with a prohibition via the CDTN contour using the Corporate files can read field, the attachment will be available to the recipient under these conditions — the contour is disabled, but the IP mask is filled in, and the user is within this network;
• with a prohibition via the role model (with contour restriction), the attachment will be unavailable to the recipient under these conditions.

The following describes rule fields and their effect.

Select contour

Not applicable to Smart Apps, applies only to the messenger. Requires a configured CDTN contour.

This rule makes sense if the user from the group is inside the CDTN.

Type	Results
Images	Parameter Action All except internal loop users Only users of this server who are in the same contour can download the image . All except trust loop users Only users of this server or a trusted server who are in their own contour will be able to download the image . The chat will display “This file is unavailable” when the prohibition applies to an external user.
Videos	⚠️ Video larger than 50 MB is sent as a document. Parameter Action All except internal loop users Only users of this server who are in the same contour will be able to download the video . All except trust loop users Only users of this or a trusted server who are within their own contour can download the video . The chat will display “This file is unavailable” when the prohibition applies to an external user.
Documents	Parameter Action All except internal loop users Only users of this server who are in the same contour can download the document . All except trust loop users Only users of this or a trusted server who are in their own contour will be able to download the document . The chat will display “This file is unavailable” when the prohibition applies to an external user.

Select the users for whom the action will be restricted

Not applicable to Smart Apps, applies only to the messenger.

Type	Results
Images	Parameter Action All except users from trusted servers Only users from the group who are on the current or trusted server will be able to download the image. Others will receive an error. All except users from own server Only users from the group who are on the current server will be able to download the image. Others will receive an error. Public users and guests Only corporate users on any corporate server will be able to download the image. Public users will receive an error. The chat will display “This file is unavailable” when the prohibition applies to an external user.
Videos	⚠️ Note that videos are sent as documents if their size exceeds 50 MB! Parameter Action All except users from trusted servers Only users from the group who are on the current or trusted server will be able to download the video. Others will receive an error. All except users from own server Only users from the group who are on the current server will be able to download the video. Others will receive an error. Public users and guests Only corporate users on any corporate server will be able to download the video. Public users will receive an error. The chat will display “This file is unavailable” when the prohibition applies to an external user.
Documents	Parameter Action All except users from trusted servers Only users from the group who are on the current or trusted server will be able to download the document. Others will receive an error. All except users from own server Only users from the group who are on the current server will be able to download the document. Others will receive an error. Public users and guests Only corporate users on any corporate server will be able to download the document. Public users will receive an error. The chat will display “This file is unavailable” when the prohibition applies to an external user.

Select the chat type to be restricted

Not applicable to Smart Apps, applies only to the messenger. This is an additional parameter that limits the scope of the rule.

Type	Results
Images	Parameter Action Select a chat The prohibition for recipients to download images from users with CTS will only apply in this specific chat. Only group chats and channels without end-to-end encryption The prohibition for recipients to download images from users with CTS will only apply in group chats or channels without end-to-end encryption. Only group chats and channels with end-to-end encryption The prohibition for recipients to download images from users with CTS will only apply in group chats or channels with end-to-end encryption. Only personal chats The prohibition for recipients to download images from users with CTS will only apply in personal 1-1 chats.
Videos	⚠️ Note that videos are sent as documents if their size exceeds 50 MB! Parameter Action Select a chat The prohibition for recipients to download videos from users with CTS will only apply in this specific chat. Only group chats and channels without end-to-end encryption The prohibition for recipients to download videos from users with CTS will only apply in group chats or channels without end-to-end encryption. Only group chats and channels with end-to-end encryption The prohibition for recipients to download videos from users with CTS will only apply in group chats or channels with end-to-end encryption. Only personal chats The prohibition for recipients to download videos from users with CTS will only apply in personal 1-1 chats.
Documents	Parameter Action Select a chat The prohibition for recipients to download documents from users with CTS will only apply in this specific chat. Only group chats and channels without end-to-end encryption The prohibition for recipients to download documents from users with CTS will only apply in group chats or channels without end-to-end encryption. Only group chats and channels with end-to-end encryption The prohibition for recipients to download documents from users with CTS will only apply in group chats or channels with end-to-end encryption. Only personal chats The prohibition for recipients to download documents from users with CTS will only apply in personal 1-1 chats.

Exception chats

The rule does not apply to selected chats. Exception chats can be selected only when creating a local rule, that is, when a field is filled in the Prohibition function group.

“Require pin” Rule

This role model rule requires creating a PIN code for additional app protection.

When Does the Rule Trigger?

• A user logging into the app will see a screen for creating a mandatory PIN code, which cannot be skipped:

  Platform	Action
  iOS	Immediately after authentication.
  Android, Desktop (any app) or Web (ETS app only, if enabled in the build)	Upon the next app launch.

• a user who has already signed in to the app will see the screen for mandatory PIN code creation when the app restarts, when reconnecting to the network on all platforms, and after the post-check triggers. During post-check, rules are requested again, and the user receives all rules relevant to them.

How Does the Rule Work in Client Apps?

Platform	Action
iOS and Android	Disable PIN button disappears.
Desktop (any app) or Web (ETS app only, if enabled in the build)	The Disable PIN-code button remains: the user changes the PIN code with it, and this option remains available to them. After clicking this button in the web/desktop app, the user is immediately taken to the screen for creating a new mandatory PIN code.

I Switched the Rule, but Nothing Happened. Why?

If you enable or disable the “Require pin” rule or the role model itself, the PIN code creation screen may appear or disappear with a delay. This will happen only after restarting the application or reconnecting to the network. This happens more often on Android and less often on iOS — for example, when you disable a rule.

How to Set the Time After Which Auto-Lock by PIN Code Will Be Activated?

In the role model, there is no such setting yet, because in the web/desktop application you cannot set the auto-lock time for PIN code entry.

In mobile apps, auto-lock occurs by default after 5 minutes, and this time can be changed in the app settings. If an Android user has already set a different auto-lock time, it will be saved. The user can change it at any time.

---

Configuring SmartApps Visibility in the SmartApps Catalog

This is the only rule that is set in the bot or SmartApp settings in the “Bots” section. Other rules are configured in the Role model (messaging) section.

What Is Required for the Rule to Work?

For the rule to work:

• Activate the role model.
• Use the standard catalog: in the admin panel, open the SmartApps section, select the SmartApps catalog enabled check box, and in the field APP_ID below it, select Default catalog or homescreen-smartapp-catalog.

How to Restrict SmartApp Visibility?

To configure SmartApp visibility in the SmartApps catalog in the app:

1. In the admin panel, go to the “Bots” section.
2. Click the pencil button next to the desired SmartApp.
3. Specify the Availability: for all users or specific user groups. If specific groups are selected, the SmartApp will only appear in the catalog for users from these groups. In the Contacts section, it will remain available to everyone regardless of the settings.
4. Save the changes.

How to Hide a SmartApp on a Specific Client Platform?

In the settings of the user group that should see the SmartApp, clear the checkbox for that client platform (for example, iOS).

Rule Operation Example

How availability settings affect visibility, using the Calendar SmartApp as an example:

Availability Setting	Visibility in Contacts	Visibility in SmartApps Catalog
All	Calendar SmartApp is available in the Contacts section.	A user not in the group sees Calendar SmartApp in the smart apps catalog (the “9 dots” menu).
Specific Role Model User Group (user is NOT in the group)	Calendar SmartApp is available in the Contacts section.	A user not in the group does not see Calendar SmartApp in the smart apps catalog (the “9 dots” menu).

How Do I Hide All SmartApps From Everyone Except One Group?

Make all SmartApps available only to this group. What other users see depends on what is selected as the catalog in the SmartApps section.

What Is Selected in the Catalog	What Happens and What to Do
A separate SmartApp	In its settings, set Availability to all users. Make the other SmartApps available only to the required group.
Default catalog	This catalog is a feature of the application itself: it shows the list of SmartApps available to the user. It is not in the list of bots, so availability settings do not apply to it. Users without access will see an empty catalog or the message “The catalog is hidden by your server admin” in the mobile app.

To make sure no one sees an empty catalog:

1. In the SmartApps section, clear the SmartApps Catalog enabled check box.
2. Open SmartApps > Mobile clients menu and select the Menu configuration enabled check box.
3. Drag each SmartApp into the Quick features block and click Save.

In the mobile app, SmartApps appear in quick features only for users who have access to them.

In the web and desktop app, if the SmartApps Catalog enabled check box is cleared, no one has the catalog: the catalog button on the left pane and the catalog in the Home SmartApp disappear. The user can still find available SmartApps in the Contacts section.

Forbid Clipboard Usage in Application

This rule can apply to both the messenger and Smart App. Available since 3.46 version.

If enabled:

• Forbids using the device's clipboard while the app is open: copying message text, pasting text, copying text when viewing documents, etc. You can copy and paste in the message field BEFORE the message is sent.
• The Copy/Paste context menu buttons are hidden; pressing the keyboard shortcuts for copy/paste has no effect.

If the Branded Build of the App for ETS Also Has a Clipboard Restriction, How Do They Interact?

Works with the built-in restrictions in the ETS app as follows:

• If a restriction is configured in the role model, it is used;
• If a restriction is not configured in the role model, the built-in restriction from the ETS app build is used if there is one.

Forbid Screenshot Creation

This rule applies to both messenger and Smart App — cannot apply separated. Available since 3.46 version.

If enabled:

• Prevents taking screenshots while the app is active. When focus is on another window or app, the restriction does not work.
• The area of the client app that is not in focus turns black.

The Rule Is Enabled. Why Can Screenshots Still Be Taken in the Web App?

⚠️ It is technically impossible to block screenshots in the web app, so this restriction does not work there.

If the Branded Build of the Application for ETS Also Has a Screenshot Restriction, How Do They Interact?

Works with the built-in restrictions in the ETS app as follows:

• If a restriction is configured in the role model, it is used;
• If a restriction is not configured in the role model, the built-in restriction from the ETS app build is used if there is one.