When setting up user and group rules, it is important to understand inheritance and how inheritance works.  Otherwise you may run into unexpected access rights for your groups and users.

Global to object level hierarchy

By default, groups and users will inherit rights from the highest level.

The highest level starts at the Global Settings level.  The second level is the folder level; and finally the lowest level is at the object level.  If we set rights at the current level itself, then those rights have precedence over inheritance (except if rights have explicitly been denied)

Here are a few examples of setting up a group at multiple levels

Understanding the Business Objects security model will enable you to map out a content management strategy for your organization.  Visit my previous post at http://davidlai101.com/blog/2008/11/06/content-management-planning-in-business/ after understanding user access levels and inheritance to setup your content. In this article we’ll go through the Business Objects Enterprise Access Levels.

There are 2 ways of assigning access in Business Objects Enterprise

Predefined Access Levels

Predefined access levels are a collection of individual rights that have been set up in the Business Objects Enterprise system to provide common user access requirements.

Advanced rights

By going into the advanced rights, you may totally customize the type of access a user has on an object.