DAC Definitions

When you create a DAC definition, you must specify the DAC Definition name and the Derived Relationship Family. Once you save this information, you cannot modify the definition to include a different DR Family. The DR Family defines the root ItemType of the DAC Definition.

You need to create a Subdomain policy for each of the DR Family elements and the associated subdomains. The Subdomain name is the same as the corresponding Derived Family element. The ItemType for the subdomain items is the Derived Family element destination ItemType.

You may then define a DAC Subdomain policy for each of the subdomains included in the DAC Domain definition. Once you create a DAC definition, you need to activate it. The following diagram shows the DAC Definition Lifecycle.

Figure 29. When a DAC Definition is in the Preliminary state, it means that it is being created/edited. The appropriate DAC domains have not been created yet. In this state the DAC domain has no effect on access control. Once you create and validate a DAC Definition, the Administrator activates it. The corresponding DAC Domains are created dynamically using new root items. The Access Control logic takes this information into account when determining an access request. The procedure described in the following section is an example of creating a DAC Definition.