Understanding key concepts

Permissions: Fine-grained access that determines a specific action a user can take within the application.

For example:

Roles: A collection of permissions tied to a business function.

For example, the role of a cardiologist may include permissions such as:

Groups: A logical collection of users (user directory) who share the same access requirements often mapped to roles for simplified management.

Group-inheritance policy

A group auto-inheritance policy defines how users automatically inherit access permissions and roles based on their group membership, enabling scalable access control. Application owners can assign one or more roles to a group. Users assigned to the group automatically inherit access to resources through roles nested under the group, ensuring compliance with the Principle of Least Privilege (POLP).

However, for legacy applications that were migrated into Aikyam, this auto-inheritance is disabled by default. In such cases, business advocates are required to manually assign roles to users within each group.

By understanding different types of access control, such as role-based, and group-based, access control, you can develop a robust and adaptable security strategy. This ensures sensitive patient health information (PHI) remains secure while granting the right people access to the necessary resources.

The two common access control methodologies are:

Model	Description	Example
Role-Based Access control	Has a collection of permissions that correspond to specific job functions or responsibilities are assigned based on pre-defined roles within an organization	Role: Claims processor Permissions: View and edit insurance claims: View_Coverage Generate and export claims status reports: Generate_Claims, Export_ClaimsHistory Role: Claims Viewer Permissions: Can only view insurance claims: View_Claims Role: Pharmacy manager Permissions: Read_SpecialtyOrders Track_Shipments View_Coverage
Group-Based Access control	Has a collection of roles with corresponding sets of permissions. These roles are assigned through group memberships, where each group represents a function or department within the organization.	Specialty Pharmacy Group Benefits and Claims Group Prescription Access Group

Let’s say a user is added to the Specialty Pharmacy group, which is pre-configured with the following roles:

Based on group inheritance, the user is automatically granted both roles and their respective permissions, thus provisioned access in one step based on functional need.