Policies
You read the policy in force in this Account: the permission keys granted by roles assigned in the Account, and the two values of floors inherited from the platform side by side.
For: Account administrator, Auditor
What's on this screen
- Permission rules: lines coming from roles assigned in this Account. If nobody in this Account holds a role, its rule does not appear here either.
- Floors: for each floor, the platform's value, this Account's value and where the value comes from.
- In the side panel: the deny line, how many floors are written here and how many come from the platform, and any reported gaps.
The screen works while an Account is selected in the scope switcher.
How to read a floor row
| What you see | Meaning |
|---|---|
| this account has written its own value | The Account has recorded its own value; the date is shown next to it. |
| inherited from the platform | There is no record in the Account; the platform's value applies. |
| not written in any scope | There is no value on the platform or in the Account. |
| cannot be written in the account scope | The floor is in force, but this Account cannot tighten it. |
| hidden | The value is not shown because it is secret. |
Tip The screen puts the two values side by side; it does not work out which one is stricter. The comparison is made at write time, and a loosening value is refused there; there is no exemption path.
What you should know
- An explicit deny rule count of zero is normal: no explicit deny rule has been written on this line; a denial comes from no rule matching.
- This screen is read-only. The keys roles grant change in the role studio, floor values through configuration.
- Viewing requires
policy.readin this Account.