You use access control policies to restrict user actions. In the Access Control Policy form, you define a policy that grants access to an object by evaluating the conditions that you specify. You can set one of four levels of access: read, update, discover, or delete.
For example, an access control policy for a sales automation application might restrict access to a sales account to the user who owns the account or to a user who is included in an exception list of non-owners who have access.
Access control policies are enforced everywhere in Pega Platform, not just within the UI, including all reporting rules, search, and custom SQL written by developers.
Unlike role-based access controls, attribute-based access control policies use the system's full inheritance functionality. Access policy rules can be inherited from multiple classes, in which case the relevant policies are combined and access is allowed only when all such policy conditions are satisfied.