Document classes via restriction sets 

When defining the restrictions, you have several options.

Restriction sets are defined with individual values but also with data-ranges and negative expressions and are stored as a text document.

The sets are associated to the different target objects (user, group, global, ...) too. The set of values to be checked is then only determined at runtime.

Initially you create the "containers" for the restriction sets in the d.3 admin plugin d.3 restriction sets.

In the second step, you list the values against which the comparison is to be applied later as part of the validation of rights, i.e. the valid and prohibited values.

You can associate global values (no association), user- or group-related values, but also values associated to an organizational unit (company structure).

You best create the basic entries first (no association).

The, get more precise, e.g. add further entries for a group, where only the group members (Accounting) should get additional rights. If the name of the restriction set is the same as the name of a static dataset, then you can select from the configured values.

It is thus possible, to define basic values for all (group-)members and still to configure additional extensions and restrictions for a user or group.

The association is depicted accordingly.

You can view the associated values from a user or group perspective.

In the definition of the document class, you then use the macro @D3SET, ideally by clicking the button ... at the end of the property field to select the suitable restriction set.

This document class does not need to be adjusted any more, if you want to assign extended or reduced values to the users. It is sufficient to edit the values accordingly in the restriction set!

In order not to leave this task to the d.3 administrator, you can name users in charge of assigning the values in the restriction set with reference to their respective environment and thus to respond to the immediate requirements such as staff member on sick-leave.

For this effect, such a specialist in charge get the respective rights for such a restriction set via a document class for the system document type $Restriction Set$.

In this example, a document class is defined, where a person in charge is made eligible to only care for restriction sets with the name "Sites" and only those associated to users (1). The restriction sets are accessed via d.3 smart explorer and a respective entry in the Tools menu.