PrivaceraCloud Documentation

Create scheme policies on PrivaceraCloud
:

For conceptual background and planning, see the Scheme Policies Overview.

Prerequisites for creating a scheme policy

Before creating a scheme policy, decide the following:

  • Decide which users, groups, or roles you want to apply the scheme policy to.

  • Decide how you want to give permissions to those users, groups, or role. You can either allow them or deny them the use of encryption or presentation schemes.

Steps to create scheme policies

  1. Go Access Manager > Scheme Policies.

  2. Find and click the PEG resource name.

  3. If you want this scheme policy to be in effect for only a specific time period, in the upper right, click Add Validity Period and enter the details of that period.

  4. Enter a name for the scheme policy.

  5. If desired, select any policy labels you want for this scheme policy.

  6. If you do not want audit logging, use the Audit Logging toggle to turn it off.

  7. With the Enabled toggle, you can create the policy but not yet enable it.

  8. In the Encryption Schemes field, select the name of the encryption scheme to which you want to apply the policy. Repeat this for all required encryption schemes.

  9. For Presentation Schemes field, select the name of the presentation scheme to which you want to apply the policy. Repeat this for all required presentation schemes.

  10. Enter a description of this scheme policy.

  11. Depending on how you have decided to allow or deny access, use the fields in Allow conditions or Deny Conditions and follow the corresponding steps below:

    • Allow Access

      1. Under Allow Conditions, in the role, group, and user fields, select the names of roles, groups, or users you want to give access to the schemes.

      2. On the right, click Add Permission and specify the permission you want to give. Note:

        • getSchemes permission is required for Databricks UDFs.

        • protect/unprotect permissions are required for REST API calls.

      3. On the far right, click Delegate Admin if you want the service user to be able to make API requests on behalf of the application user.

      4. If you want to deny access to specific roles, groups, or users, under Exclude from Allow Conditions, select those roles, groups, or users you want to exclude.

    • Deny Access

      1. Under Deny Conditions, in the role, group, and user fields, select the names of roles, groups, or users you want to deny access to the schemes.

      2. On the right, click Add Permission and specify the permission you want to deny.

      3. On the far right, click Delegate Admin if you want the service user to be able to make API requests on behalf of the application user.

      4. If you want to give access to specific roles, groups, or users, under Exclude from Deny Conditions, select those roles, groups, or users you want to allow.

  12. Save your scheme policy.