Permissions Comparison

What it is and why it exists

In IBM Engineering Lifecycle Management, what a user may do in a project depends on the roles of the project area and the permissions each role has: who may create or delete artifacts, change a module, approve a review, create a baseline or deliver a change set. Team areas, timelines and iterations can change those permissions again for their part of the project.

Organizations usually start every project from the same process template, and then the projects drift apart. One project lets authors delete artifacts, another gives a team area its own permissions, a third has a role the others lack. The web client shows the permissions of one project area at a time, so finding these differences means opening the same screens side by side, role by role. Permissions Comparison reads them for you and lists only what differs.

Problems it solves

• Project areas created from the same template whose permissions no longer match, and nobody knows where.
• Access reviews that require checking every role in every project area by hand.
• Team areas or iterations that quietly give a role more, or fewer, permissions than the project area.
• No evidence to show an auditor that the documented roles and permissions are the ones configured on the server.

Why it matters for standards and audits

Standards for regulated and safety-related development rarely name a tool, but they expect that only authorized people can change controlled records and that you can show who may do what. In an ELM project area that control is the role permissions. Permissions Comparison is a way to check that it is the same in every project and matches your documented process.

• FDA 21 CFR Part 11 (electronic records in medical devices and pharma): § 11.10(d) asks for "limiting system access to authorized individuals", and § 11.10(g) for authority checks, so that only authorized individuals can alter a record or perform the operation at hand. The comparison shows, per project area, which role may perform which operation.
• ISO/IEC 27001:2022: the Annex A controls 5.15 Access control, 5.18 Access rights, 5.3 Segregation of duties and 8.2 Privileged access rights. Access rights are to be reviewed regularly, and conflicting duties kept apart, for example the role that writes a requirement and the role that approves it. The Excel report records what was reviewed and when.
• ISO 26262, Automotive SPICE, DO-178C and IEC 62304: all four require configuration management and change management of work products such as requirements (ISO 26262 Part 8, SUP.8 and SUP.10 in Automotive SPICE, section 7 of DO-178C, clause 8 of IEC 62304). In DOORS Next, part of that control is which roles may modify artifacts, create baselines and deliver changes. A project whose roles allow more than the process describes is a typical audit finding.

An assessor checks a sample of projects and expects the same process in each. Compare every project area with your reference project before the assessment, and you see the differences first.

Benefits

• Every difference in one list: roles, their order and cardinality, and each permission that is allowed on one side and not on the other, for the project area, team areas and, if you want, timelines and iterations.
• One source, many targets: compare a reference project area with up to 25 others of the same application.
• Works in every ELM application: DOORS Next, Workflow Management (EWM), Test Management (ETM) and Global Configuration, from an ELM Mini Dashboard.
• Excel report with the full permission matrix, ready for an access review or an audit file.
• Read only: the widget reads and never changes a permission.

How to use

1. In Settings, choose whether to compare team areas (on at first) and timelines and iterations (off at first).
2. Under Compare, choose the Application. From is the source: on a DOORS Next dashboard it starts as the open project, and Change picks another project area.
3. Under To, click Add, tick up to 25 project areas (search, Select all and Show archived help) and click Apply.
4. Click Compare. The result block shows the number of differences, per category or per target, and the targets that could not be read, with Retry.
5. Under Differences, pick a target when there are several, then Roles or Permissions. Permissions are grouped by role and level, such as Author / Team area: Business Recovery. Click a row to see both sides.
6. Click Export to Excel in the result block to save the whole comparison.

Good to know

• Roles are matched by id, then by name, so a role with the same name and another id counts as the same role. Role order is compared because a user with several roles gets the permission of the first role that allows it.
• The widget compares roles and their permissions, not who holds them. User Audit lists which users have which roles.
• A team area, timeline or iteration where only one side gives a role its own permissions is reported as one row, not as a long list of permission differences.
• Typical moments to use it: before an audit or assessment, after changing the process template, and when a new project is set up from a template.
• The widget does not make a project compliant. It gives you the facts to check that the permissions match your documented process, and a report to keep as evidence.