1.2 Users and Permissions

In order to access any of the EIS Consoles you need to be authenticated and authorized. 
Each Console / Functionality requires at minimum to have a specific Task.
Given that the Tasks are not directly assigned to users but to roles, eventually you need to have the appropriate role.
The role may or may not have Location or Source Restrictions:

A Location Restriction limits the geographic scope within which a user may exercise a given functionality (via WUI and/or System). That scope is defined by the location, country, or set of countries contained in the Location Restriction of the role/task of the user. 
For example:
- Web User Interface: A user holding the LOCATION_MANAGER role/task with a Location Restriction Level of "User's country" will find that the country-selection list, on the Search Location page of the Geo Console, includes only their own country.
- System to System Interface: When notifying SSN for the creation of a PortPlus, a user holding the PORTPLUS_NOTIFIER role/task with a Location Restriction Level of "User's country" may only designate a PortOfCall that belongs to that same country.

A Source Restriction filters the exchange of information between an originating party (the notifier or requestor) and a counterparty (a potential recipient or source of information). It is imposed by determining whether the Source Restriction assigned to the counterparty includes the country of the originating user. A counterparty is eligible to receive from - or supply information to - the originator only when its permitted countries include the originator's country. 
For example:
- Web User Interface: On the Incident Report page of the Send Notification Console, a recipient country is present in the available recipients list only if it has at least one party whose Source Restriction includes the country of the logged-in notifier. For instance, if there is a country that has only one party/user belonging to it, and that party/user has Source Restriction Level = "XW", then only users of countries that belong to that specific regional agreement will have the country as an available recipient in the recipients list.
- System to System Interface: When notifying SSN for the creation of an incident report, each party within a recipient country receives the report only if its Source Restriction includes the country of the submitting user. For instance, a party whose Source Restriction Level is "XW" will receive reports only from notifiers of countries that belong to that specific regional agreement.

In addition the following restriction levels are applied per case:
•    None: No Location Restrictions or Source Restrictions are applied.
•    User’s country: Applies only to Location Restrictions. Restricted functionality is limited based on the user's country.
•    Specific locations: Applies only to Location Restrictions. Restricted functionality is limited based on the selected locations.
•    Countries list: Applies to both Location Restrictions and Source Restrictions. Restricted functionality is limited based on the selected list of countries.

The restriction levels for Source Restrictions and Location Restrictions are defined in the ROLES_TASKS table.

More specifically: 

• A permission (identified by the TASK column) is assigned a Source Restriction by changing the default value of the RESTRICTION_LEVEL column from None to Countries list. 
  When the restriction level is set to Countries list, the SOURCE_REGIONAL_AGREEMENT_CODE column must contain one of the Regional Agreement Codes defined in the COUNTRIES_REGIONAL_AGREEMENTS table.
• A permission is assigned a Location Restriction by changing the default value of the LOCATION_RESTRICTION_LEVEL column from None to one of the supported restriction levels:
  • User's country: The corresponding DUTY_CODE column must remain NULL.
  • Specific locations: The DUTY_CODE column must contain one of the Duty Codes defined in the ORGANISATIONS_DUTIES table.
  • Countries list: The corresponding LOCATION_REGIONAL_AGREEMENT_CODE column must contain one of the Regional Agreement Codes defined in the COUNTRIES_REGIONAL_AGREEMENTS table.

The Duty Codes determine the geographical scope of Location Restrictions when the restriction level is set to "Countries list" or "Specific locations".
The information provided by COD is used by EIS to create or update Organizations and their associated Duty Codes.
Each Duty Code is mapped to one or more Location Codes in the ORGANISATIONS_DUTIES_LOCATIONS table.
When the system evaluates the Location Restriction of a permission, it checks whether the geographical scope of the requested functionality matches a Location Code mapped to the permission's Duty Code.
For example, if a party has a Location Restriction set to Specific locations and a Duty Code of PORT_NOT, it can send PortPlus notifications only for Port of Call locations whose Location Codes are mapped to the PORT_NOT Duty Code.

The Regional Agreement Codes determine the geographical scope of Location Restrictions and Source Restrictions when the restriction level is set to Countries list.
The information provided by CCBR is used by EIS to create, update, or delete Countries and their associated Regional Agreements, where applicable.
When the system evaluates the Location Restriction and/or Source Restriction of a permission, it checks whether the geographical scope of the requested functionality belongs to the Regional Agreement specified by the permission.
For example, if a party has a Location Restriction set to Countries list and a Regional Agreement Code of "XP", it can send PortPlus notifications only for Ports of Call located in countries that are members of the "XP" regional agreement.

Below there are two tables:

• Table #1: Summarizes the minimum Task / Role that you need to have in order to access the Console / Functionality. 
• Table #2: Summarizes the association between IDM Roles / Tasks and Restrictions.

Table #1:

Table #2: