Template access groups and roles

Updated on August 3, 2022

Template access groups are provided with the Pega Customer Decision Hub and are used to generate new access groups when the user runs the new application wizard.

Template access groups

Access group name	Application where it is used
CDHTemplate:OpsDeveloper	Pega 1:1 Operations Manager
CDHTemplate:NBASpecialist	Pega 1:1 Operations Manager
CDHTemplate:OpsMgrAdmin	Pega 1:1 Operations Manager
CDHTemplate:TeamLead	Pega 1:1 Operations Manager
CDHTemplate:BusinessUser	Pega 1:1 Operations Manager
CDHTemplate:CDHAdmins	Pega Customer Decision Hub
CDHTemplate:CDHManagers	Pega Customer Decision Hub
CDHTemplate:CDHAnalysts	Pega Customer Decision Hub
CDHTemplate:CDHInstall	Pega Customer Decision Hub

CDHTemplate or MKTTemplate in the name of the access group will be automatically replaced with the name of your application. For example, if you name your application DevCo during the new application wizard, the access groups will be named DevCo:Admins, DevCo:CDHAnalysts and so on.

Associating access groups with roles

The access groups used by these operators in the application are associated with roles. Each of these roles should be built with the associated PegaNBAM_FW role as a dependent role. This ensures that any new privilege granted in Pega Customer Decision Hub will be granted to the appropriate operators automatically when upgrading your environment.

To verify that you access groups are associated with the correct role:

Open your access group to see its list of available roles.
Open the role.
Click Manage dependent role and verify that you see one of the PegaNBAM_FW roles as a dependent role.
If required, add the PegaNBAM_FW role to get the latest list of privileges.

Note: Some access groups are associated with multiple roles. The order of these roles defines the additional permissions or privileges for the access group. The Stop access checking once a relevant Access of Role to Object instance explicitly denies or grants access option is disabled for these groups, so that the permissions for these roles can accumulate.

To remove permissions, use one of the following rules:

To remove all permissions for a given rule, use an Access Deny rule. For more information, see Understanding Access Deny rules.
For a more granular permission edit, use an Access of Rule to Object rule. For more information, see Understanding Access of Role to Object rules.

Previous topic Creating operator accounts
Next topic Updating the Manager field for your organization units

Have a question? Get answers now.

Visit the Support Center to ask questions, engage in discussions, share ideas, and help others.

Visit the Support Center

Get Started with Community

Template access groups and roles