Group inheritance policy

A group auto-inheritance policy defines how users automatically inherit access permissions and roles based on their group membership, enabling scalable access control. Application owners can assign one or more roles to a group. Users assigned to the group automatically inherit access to resources through roles nested under the group, ensuring compliance with the Principle of Least Privilege (POLP).

However, for legacy applications that were migrated into Aikyam, this auto-inheritance is disabled by default. In such cases, business advocates are required to manually assign roles to users within each group .

Use case: Let’s say a user is added to the Specialty Pharmacy group, which is pre-configured with the following roles:

• Pharmacy Manager – Grants access to manage specialty inventory, read prescriptions and track shipments.
• Claims approver – Grants access to view & review claims, generate claims, export claim history.

Based on group inheritance, the user is automatically granted both roles and their respective permissions, thus provisioned access in one step based on functional need.