Best Practice Question - Setting default ACL for repository

Trupthy.Bharadwaj

We are new to Documentum, so if there already is information on this, please point me to it.

We have installed D 6.5 SP1 in our company and we have setup the Content Server's Default ACL to be 'Type' (default_acl = 2 in dm_server_config_object).
When we did this, we found that we would need to set a default ACL for every dm_sysobject created - not just objects created from our custom types.
(we were seeing errors when dm_procedure objects were created)

• Is there any recommendation on what this default ACL should look like?
• What do most users/companies do in this scenario?
  

Chris_Campbell

The decision of what default ACL to use (folder, creator or type) is going to depend on how your repository is going to be used by your users and what you are storing.  Some companies have several repositories and use a different default ACL based on several sets of criteria.  Other companies just have one repository and have to choose the best default ACL that fits all scenarios.

Quick review of the three default ACLs that can be used:

• Folder - When a object is first stored or created it inherits the ACL of the folder it is located in.
• Creator - An object inherits the ACL of the person who created it.
• Type - An object inherits the default ACL as defined for that object type.

Each has it's advantages and disadvantages.  It's a good thing that ACLs can change, and frequently do in a busy repository, so choosing the wrong default ACL isn't the end of the world.  It does make things easier initially.

Most people that I've come in contact with use the Folder ACL.  Most repositories are a general library of information with lots of people viewing and creating material.  Most organization that is done is through cabinets and folders.  It's also what most people are familiar with since most computer networks employ this type of security.

The next most often used is the Type ACL.  This is usually done in multi-repository installations in my experience, where the repository is specifically targeted towards a department or purpose.  Since not many people might use the repository, type-based ACLs are handy for quickly catagorizing material.  Medical and legal companies tend to gravitate towards this it seems.  The downside is that you need to make sure that you set up your types and ACLs way ahead of time before your repository gets heavy use.

One that I don't see getting used a lot is the Creator ACL.  To be used correctly, it does take some forethought, some extra maintenance than the folder ACL, but can be very powerful if you have content shared in a few folders, have a lot of people using the repository, but you want to protect content from some groups or individuals.  If you're not careful, using Creator ACLs will be a nightmare if each user has a unique ACL as their default.  Then you'll end up with hundreds of files with hundreds of individual ACLs.  Slows the system down and when one person has a corrupted ACL or is deleted.... oh boy.  However, if used correctly sensitive material can be kept within hand but out of sight.  Personally, I tend to shy away from Creator ACLs as being the default because it has too many potential downsides and there are workarounds that do the same things as Creator ACLs using Folder or Type.

For you... I'd go with Folder.  If you plan on using workflows and lifecycles, then you'll probably be applying different lifecycles to your documents through them anyway.  The way I design systems, most objects that are created or imported are through forms or through a workflow.  The first thing that usually happens is a TBO applies the ACL or the workflow does it for me.  That's why I use Folder ACL as the default 99.97% of the time.

Hope this helps!