Oracle Applications Cloud Roles
Oracle Applications Cloud controls access to its financial, supply chain, and human capital management applications through a role-based security model in which permissions are granted to users indirectly, by way of predefined and custom roles rather than by the individual assignment of every action.[^c1] A role collects the functions and data a person may use, and role-based access control is the foundation on which the rest of the security architecture is built. The role types span a layered structure that runs from individual actions, through process-level groupings, up to the profiles granted to users, and they are designed, assigned, and audited through centralized administration tools.
The model is layered. At the base sit privileges, the individual actions such as creating, editing, or submitting a record. These are gathered into duty roles, each of which groups the privileges for a single business process, and into aggregate privileges, which are fixed packages of privileges that cannot be split apart.[^c3][^c7] Job roles form the top level that is actually granted to a user, containing duty roles, aggregate privileges, and even other job roles; abstract roles are a generic category of job role used across the organization rather than for a specific position.[^c2][^c4] In human capital management a further construct, the data role, pairs a job or abstract role with security profiles that limit the records a user may see.
These types combine into hierarchies in which each role inherits the contents of the roles beneath it, so granting one job role can carry an entire tree of duty roles and privileges to the user.[^c5] Custom roles are built and maintained on the Security Console, which centralizes creating, editing, copying, and viewing role definitions.[^c6] Because out-of-the-box roles can carry excessive access and segregation-of-duties conflicts, organizations frequently redesign roles during cloud implementation. Segregation-of-duties policies are enforced at the time a role is provisioned rather than at the time it is defined, so conflicting role combinations must be caught during role creation and editing; the Security Console provides a dedicated analysis page that evaluates a role's hierarchy against the segregation-of-duties rules before the role reaches users.[^c8][^c9] Organizations therefore monitor role assignments and sensitive access on a recurring basis to satisfy audit and compliance requirements.
The role types are surveyed in [[Role Types Overview]] and examined individually in [[Purpose of Job Roles]], [[Purpose of Duty Roles]], and [[Definition of Aggregate Privileges]]. How the pieces combine is covered in [[Role Inheritance and Composition]], and practical administration is treated in [[Creating Custom Roles]] and [[Role Auditing and Monitoring]].