RegContent

Documentum ACL permissions (1–7)

The integer in r_accessor_permit is the basic permit for one accessor on a dm_acl. Documentum Administrator calls the same object a permission set. Higher basic permits include all lower ones.

Basic permits (screenshot this)

Int Name IDfACL constant What it allows
0 Null — Empty / unset slot on the repeating attribute. Not a grant.
1 None DF_PERMIT_NONE No access. The object is not visible in search or navigation for that accessor.
2 Browse DF_PERMIT_BROWSE Metadata and listing only. No content.
3 Read DF_PERMIT_READ View content.
4 Relate DF_PERMIT_RELATE (also DF_PERMIT_NOTE) Annotations / relationships. RELATE and NOTE are the same value.
5 Version DF_PERMIT_VERSION Checkout and a new version. Cannot overwrite the same version.
6 Write DF_PERMIT_WRITE Modify content and attributes; save the same version or a new one.
7 Delete DF_PERMIT_DELETE Delete, plus every lower basic right.

String companions exist on IDfACL as well: DF_PERMIT_NONE_STR, DF_PERMIT_BROWSE_STR, DF_PERMIT_READ_STR, DF_PERMIT_RELATE_STR, DF_PERMIT_VERSION_STR, DF_PERMIT_WRITE_STR, DF_PERMIT_DELETE_STR.

Hierarchy

Basic permits are cumulative. Write (6) includes Version, Relate, Read, Browse. Delete (7) includes Write. None (1) is an explicit “this accessor does not see it,” which is different from simply omitting the accessor (the user may still match dm_world or a group).

Where it is stored

On dm_acl, aligned repeating attributes:

A SysObject points at an ACL with acl_name + acl_domain (the ACL owner). System ACLs often use dm_dbo as domain.

SysObject _permit is the resolved basic permit for the current user (or a named user, depending on how you fetch it). 0 means the object is not a SysObject, not “None.” Values 2–7 are Browse through Delete for that resolved accessor.

Extended permissions

Extended permissions are not cumulative. They are stored in r_accessor_xpermit as a bitfield. Read and write them through DFC (getAccessorXPermitNames, grant with a comma-separated name list). Do not hand-decode the integer unless you have the server’s encoding in front of you — two bits are inverted relative to the others.

Names (what they allow):

Name IDfACL string constant Allows
Execute Procedure DF_XPERMIT_EXECUTE_PROC_STR Run the object if it is a procedure.
Change Location DF_XPERMIT_CHANGE_LOCATION_STR Move / change the object’s location.
Change State DF_XPERMIT_CHANGE_STATE_STR Promote / demote via the attached lifecycle.
Change Permit DF_XPERMIT_CHANGE_PERMIT_STR Change the object’s permissions (ACL).
Change Owner DF_XPERMIT_CHANGE_OWNER_STR Change owner_name.
Delete Object DF_XPERMIT_DELETE_OBJECT_STR Destroy the object. This extended right does not grant Browse–Write.
Change Folder Links DF_XPERMIT_CHANGE_FOLDER_LINKS_STR Bypass folder security when linking / unlinking (Content Server 6.0+).

If you call IDfACL.grant and pass null for the extended-permit string, the server supplies defaults that include Change Location and Execute Procedure.

r_permit_type

Each accessor row has a permit type. Names from the object reference:

Default type is AccessPermit (0). RequiredGroup / RequiredGroupSet require a group name in r_accessor_name. Restriction and required-group types are Trusted Content Services features on licensed servers; AccessPermit and ExtendedPermit are available without that license.

DQL

SysObject → ACL name and domain:

select object_name, owner_name, acl_name, acl_domain
from dm_sysobject
where r_object_id = '09xxxxxxx'

Dump accessors on a named ACL (system ACL example):

select r_accessor_name, r_accessor_permit, r_accessor_xpermit
from dm_acl
where object_name = 'dm_4500_read'
and owner_name = 'dm_dbo'

Objects using a given ACL:

select r_object_id, object_name
from dm_sysobject
where acl_name = 'my_acl' and acl_domain = 'dmadmin'

Grant and revoke belong in DFC (IDfACL.grant / grantPermit), not in a casual DQL UPDATE of the repeating attributes. ACLs are protected objects.

Related