[ver]
	4
[sty]
	
[files]
[charset]
	82
	ANSI (Windows, IBM CP 1252)
[revisions]
	0
[master]
	
	C:\AMIPRO\DOCS\DBMGR\index.SAM
	0
	0
	0
[sequence]
	11
	0
	0
	0
	10
	4
	Numbered list
	0
	Bullet
	0
	Indnt bullet
	0
	Indnt caution
	0
	Indnt tip
	0
	Indnt note
	0
	Caution
	0
	Tip
	0
	Note
	0
	Footnote
[prn]
	PostScript (QMS)
[port]
	LPT3:
[lang]
	1
[fldnames]
	Field1
	Field2
	Field3
	Field4
	Field5
	Field6
	Field7
	Field8
[desc]
	
	
	
	
	
	801536197
	113
	781574309
	1941
	20
	0
	0
	0
	0
	
	
	
	
	
	
	1
[fopts]
	0
	1
	0
	0
	
	
[lnopts]
	2
	Body Text
	1
[docopts]
	5
	2
[GramStyle]
	
[ParaNum]
	1
[tag]
	Body Text
	2
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		40
		240
		4
		0
		120
		4
		100
	[brk]
		100
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		18944
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		0
		.
		,
		
	Body Text
	4
	1
	2280
	1
	2869
	1
	3480
	1
	4080
	0
[tag]
	Ahead
	3
	[fnt]
		Helvetica
		240
		0
		16385
	[algn]
		1
		1
		0
		0
		0
	[spc]
		40
		280
		4
		360
		120
		4
		100
	[brk]
		80
	[line]
		9
		0
		4
		0
		1
		1
		1
		110
		10
		1
	[spec]
		0
		2
		
		0
		1
		1
		0
		2
		0
		0
	[nfmt]
		256
		1
		0
		.
		,
		
	Body Text
	0
	0
[tag]
	Bhead title
	4
	[fnt]
		Helvetica
		220
		0
		16385
	[algn]
		1
		3
		960
		0
		0
	[spc]
		40
		260
		4
		100
		90
		4
		100
	[brk]
		80
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		3
		
		0
		1
		1
		0
		2
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	Body Text
	0
	0
[tag]
	Chead title
	5
	[fnt]
		Helvetica
		200
		0
		16385
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		40
		240
		4
		80
		0
		4
		100
	[brk]
		80
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		4
		
		0
		1
		1
		0
		2
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	Body Text
	0
	0
[tag]
	Bhead
	6
	[fnt]
		Helvetica
		220
		0
		16385
	[algn]
		1
		3
		960
		0
		0
	[spc]
		40
		260
		4
		100
		90
		4
		100
	[brk]
		80
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		3
		
		0
		1
		1
		0
		2
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	Body Text
	0
	0
[tag]
	Chead
	7
	[fnt]
		Helvetica
		200
		0
		16385
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		40
		240
		4
		80
		0
		4
		100
	[brk]
		80
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		4
		
		0
		1
		1
		0
		2
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	Body Text
	0
	0
[tag]
	Numbered list
	8
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		1704
		336
		336
	[spc]
		40
		240
		4
		0
		80
		4
		100
	[brk]
		68
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		6
		<*:>.
		0
		3
		1
		1
		2
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	Numbered list
	0
	0
[tag]
	1st lev para
	9
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		2040
		0
		0
	[spc]
		40
		240
		4
		0
		80
		4
		100
	[brk]
		68
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		0
		1
		1
		1
		0
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	1st lev para
	0
	0
[tag]
	Bullet
	11
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		1740
		300
		300
	[spc]
		40
		240
		4
		0
		80
		4
		100
	[brk]
		64
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		<*1>
		0
		3
		1
		1
		0
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	bullet
	0
	0
[tag]
	Indnt bullet
	12
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		2064
		216
		216
	[spc]
		40
		240
		4
		0
		80
		4
		100
	[brk]
		64
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		<*1>
		0
		3
		1
		1
		0
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	Indnt bullet
	0
	0
[tag]
	2nd lev para
	0
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		2280
		0
		0
	[spc]
		40
		240
		4
		0
		80
		4
		100
	[brk]
		4
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		0
		1
		1
		1
		0
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	2nd lev para
	0
	0
[tag]
	See also prnt
	0
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		40
		240
		4
		0
		120
		4
		100
	[brk]
		36
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		18944
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		0
		.
		,
		
	See also prnt
	4
	1
	2280
	1
	2869
	1
	3480
	1
	4080
	0
[tag]
	Book art
	0
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		40
		240
		4
		0
		120
		4
		100
	[brk]
		36
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		18944
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		0
		.
		,
		
	Book art
	4
	1
	2280
	1
	2869
	1
	3480
	1
	4080
	0
[tag]
	Callout text
	0
	[fnt]
		Helvetica
		160
		0
		16384
	[algn]
		1
		3
		0
		0
		0
	[spc]
		40
		180
		4
		0
		0
		3
		100
	[brk]
		0
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		0
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	Callout text
	0
	0
[tag]
	Figure title
	0
	[fnt]
		Helvetica
		180
		0
		16385
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		40
		220
		4
		40
		80
		4
		100
	[brk]
		0
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		0
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	Figure title
	0
	0
[tag]
	Chapter title
	0
	[fnt]
		Helvetica
		320
		0
		16385
	[algn]
		1
		3
		0
		0
		0
	[spc]
		40
		360
		4
		0
		480
		3
		100
	[brk]
		16
	[line]
		9
		0
		3
		0
		1
		3
		1
		644
		10
		1
	[spec]
		0
		1
		
		0
		1
		1
		0
		2
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	Chapter title
	0
	0
[tag]
	1st pg foot
	0
	[fnt]
		Palatino
		180
		0
		49153
	[algn]
		2
		3
		0
		0
		0
	[spc]
		40
		220
		4
		60
		0
		4
		100
	[brk]
		0
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		0
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	1st pg foot
	0
	0
[tag]
	Right pg foot
	0
	[fnt]
		Palatino
		180
		0
		49153
	[algn]
		2
		3
		0
		0
		0
	[spc]
		40
		220
		4
		60
		0
		4
		100
	[brk]
		0
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		0
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	Right pg foot
	0
	0
[tag]
	Left pg foot
	0
	[fnt]
		Palatino
		180
		0
		49153
	[algn]
		1
		3
		0
		0
		0
	[spc]
		40
		220
		4
		60
		0
		4
		100
	[brk]
		0
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		0
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	Left pg foot
	0
	0
[tag]
	Table title
	0
	[fnt]
		Helvetica
		180
		0
		16385
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		40
		220
		4
		40
		80
		4
		100
	[brk]
		16
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		8
		
		0
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	Table title
	0
	0
[tag]
	Table col hd
	0
	[fnt]
		Palatino
		180
		0
		49154
	[algn]
		1
		3
		0
		0
		0
	[spc]
		40
		220
		4
		0
		0
		3
		100
	[brk]
		4
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		7
		
		0
		1
		1
		0
		0
		0
		0
	[nfmt]
		272
		1
		0
		
		
		
	Table col hd
	0
	0
[tag]
	Table Text
	0
	[fnt]
		Palatino
		180
		0
		49152
	[algn]
		1
		3
		0
		0
		0
	[spc]
		40
		220
		4
		0
		0
		4
		100
	[brk]
		4
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		0
		1
		1
		0
		0
		0
		0
	[nfmt]
		272
		1
		0
		
		
		
	Table Text
	0
	0
[tag]
	See also hlp
	0
	[fnt]
		Helvetica
		200
		0
		16385
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		40
		240
		4
		80
		0
		4
		100
	[brk]
		16
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		0
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	See also hlp
	0
	0
[tag]
	See also btn
	0
	[fnt]
		Helvetica
		200
		0
		16384
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		40
		240
		4
		80
		0
		4
		100
	[brk]
		0
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		0
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	See also btn
	0
	0
[tag]
	Crossref
	0
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		2040
		0
		0
	[spc]
		40
		240
		4
		0
		40
		4
		100
	[brk]
		4
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		0
		1
		1
		1
		0
		0
		0
	[nfmt]
		256
		1
		2
		.
		,
		$
	Crossref
	0
	0
[tag]
	Indnt caution
	0
	[fnt]
		Helvetica
		200
		0
		16384
	[algn]
		1
		3
		2040
		900
		0
	[spc]
		40
		240
		4
		0
		80
		4
		100
	[brk]
		4
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		Caution
		0
		3
		1
		1
		0
		0
		0
	[nfmt]
		272
		1
		2
		.
		,
		$
	Indnt caution
	0
	0
[tag]
	Indnt tip
	0
	[fnt]
		Helvetica
		200
		0
		16384
	[algn]
		1
		3
		2040
		480
		0
	[spc]
		40
		240
		4
		0
		80
		4
		100
	[brk]
		4
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		Tip
		18944
		3
		1
		1
		0
		0
		0
	[nfmt]
		272
		1
		2
		.
		,
		$
	Indnt tip
	0
	0
[tag]
	Indnt note
	0
	[fnt]
		Helvetica
		200
		0
		16384
	[algn]
		1
		3
		2040
		600
		0
	[spc]
		40
		240
		4
		0
		80
		4
		100
	[brk]
		4
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		Note
		0
		3
		1
		1
		0
		0
		0
	[nfmt]
		272
		1
		2
		.
		,
		$
	Indnt note
	0
	0
[tag]
	Caution
	0
	[fnt]
		Helvetica
		200
		0
		16384
	[algn]
		1
		3
		1680
		900
		0
	[spc]
		40
		240
		4
		0
		80
		4
		100
	[brk]
		4
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		Caution
		0
		3
		1
		1
		0
		0
		0
	[nfmt]
		272
		1
		2
		.
		,
		$
	Caution
	0
	0
[tag]
	Tip
	0
	[fnt]
		Helvetica
		200
		0
		16384
	[algn]
		1
		3
		1680
		480
		0
	[spc]
		40
		240
		4
		0
		80
		4
		100
	[brk]
		4
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		Tip
		18944
		3
		1
		1
		0
		0
		0
	[nfmt]
		272
		1
		2
		.
		,
		$
	Tip
	0
	0
[tag]
	Note
	0
	[fnt]
		Helvetica
		200
		0
		16384
	[algn]
		1
		3
		1680
		600
		0
	[spc]
		40
		240
		4
		0
		80
		4
		100
	[brk]
		4
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		Note
		0
		3
		1
		1
		0
		0
		0
	[nfmt]
		272
		1
		2
		.
		,
		$
	Note
	0
	0
[tag]
	Mono
	0
	[fnt]
		Courier
		180
		0
		32769
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		24
		220
		4
		0
		120
		4
		100
	[brk]
		4
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		0
		1
		1
		0
		0
		0
		0
	[nfmt]
		280
		1
		2
		.
		,
		$
	Mono
	0
	0
[tag]
	Indnt mono
	0
	[fnt]
		Courier
		180
		0
		32769
	[algn]
		1
		3
		2040
		0
		0
	[spc]
		24
		220
		4
		0
		120
		4
		100
	[brk]
		4
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		0
		1
		1
		0
		0
		0
		0
	[nfmt]
		280
		1
		2
		.
		,
		$
	Indnt mono
	0
	0
[tag]
	Dhead
	0
	[fnt]
		Palatino
		200
		0
		49153
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		24
		240
		4
		0
		0
		4
		100
	[brk]
		16
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		5
		
		0
		1
		1
		0
		2
		0
		0
	[nfmt]
		280
		1
		2
		.
		,
		$
	Dhead
	0
	0
[tag]
	Parameter
	0
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		24
		240
		4
		0
		0
		4
		100
	[brk]
		16
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		0
		1
		1
		0
		0
		0
		0
	[nfmt]
		280
		1
		2
		.
		,
		$
	Parameter
	0
	0
[tag]
	Formula
	0
	[fnt]
		Helvetica
		180
		0
		16384
	[algn]
		1
		3
		2040
		0
		0
	[spc]
		40
		220
		4
		0
		80
		4
		100
	[brk]
		4
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		0
		1
		1
		1
		0
		0
		0
	[nfmt]
		272
		1
		2
		.
		,
		$
	Formula
	0
	0
[tag]
	Browse
	0
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		40
		240
		4
		0
		120
		4
		100
	[brk]
		36
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		18944
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		0
		.
		,
		
	Browse
	4
	1
	2280
	1
	2869
	1
	3480
	1
	4080
	0
[tag]
	Keyword
	0
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		40
		240
		4
		0
		120
		4
		100
	[brk]
		36
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		18944
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		0
		.
		,
		
	Keyword
	4
	1
	2280
	1
	2869
	1
	3480
	1
	4080
	0
[tag]
	Context
	0
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		40
		240
		4
		0
		120
		4
		100
	[brk]
		36
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		18944
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		0
		.
		,
		
	Context
	4
	1
	2280
	1
	2869
	1
	3480
	1
	4080
	0
[tag]
	Title
	0
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		40
		240
		4
		0
		120
		4
		100
	[brk]
		36
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		18944
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		0
		.
		,
		
	Title
	4
	1
	2280
	1
	2869
	1
	3480
	1
	4080
	0
[tag]
	Macros
	0
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		40
		240
		4
		0
		120
		4
		100
	[brk]
		36
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		18944
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		0
		.
		,
		
	Macros
	4
	1
	2280
	1
	2869
	1
	3480
	1
	4080
	0
[tag]
	Footnote
	0
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		2400
		720
		0
	[spc]
		24
		240
		4
		0
		80
		4
		100
	[brk]
		4
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		<*:>
		0
		1
		1
		256
		0
		0
		0
	[nfmt]
		280
		1
		2
		.
		,
		$
	Footnote
	0
	0
[tag]
	Alink
	0
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		40
		240
		4
		0
		120
		4
		100
	[brk]
		36
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		18944
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		0
		.
		,
		
	Alink
	4
	1
	2280
	1
	2869
	1
	3480
	1
	4080
	0
[tag]
	Butnbar
	0
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		40
		240
		4
		0
		120
		4
		100
	[brk]
		36
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		18944
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		0
		.
		,
		
	Butnbar
	4
	1
	2280
	1
	2869
	1
	3480
	1
	4080
	0
[tag]
	Window
	0
	[fnt]
		Palatino
		200
		0
		49152
	[algn]
		1
		3
		1680
		0
		0
	[spc]
		40
		240
		4
		0
		120
		4
		100
	[brk]
		36
	[line]
		8
		0
		1
		0
		1
		1
		1
		10
		10
		1
	[spec]
		0
		0
		
		18944
		1
		1
		0
		0
		0
		0
	[nfmt]
		256
		1
		0
		.
		,
		
	Window
	4
	1
	2280
	1
	2869
	1
	3480
	1
	4080
	0
[frm]
	4
	1573060
	720
	960
	9206
	2329
	0
	1
	1
	1 0 0 0 0 0 0
	0
	16777215
	8
	0
	10495
	65280 255
	[frmlay]
		6475
		8486
		1
		0
		0
		1
		960
		0
		0
		2
		0
		0
		0
		0
		1
		984
		11256
		0
	[tbl]
		 4 3 0 86 5169 86 5 43 43
		[h]
			 0 220 86 2 0 2 0
			 1 660 86 2 0 1 0
			 2 440 86 2 0 1 0
			 3 1240 86 2 0 1 0
		[e]
		[w]
			 0 1440 86 2 0
			 1 3757 86 2 0
			 2 4384 86 2 0
		[e]
		[data]
			 0 1 0 0 0 0 0 1 0 0 0 0
<+!>Access level conflict<-!>

>
			 0 2 0 0 0 0 0 1 0 0 0 0
<+!>Resolution<-!>

>
			 1 1 0 0 0 0 0 1 0 0 0 0
A name is listed in an ACL individually and as member of a group.

>
			 1 2 0 0 0 0 0 1 0 0 0 0
The access level assigned to the individual name takes precedence over the access level for the group, even if the individual access level is lower than the group level.

>
			 2 1 0 0 0 0 0 1 0 0 0 0
A name is included in two or more groups.

>
			 2 2 0 0 0 0 0 1 0 0 0 0
The name receives the access of the group with the highest access.

>
			 3 1 0 0 0 0 0 1 0 0 0 0
A name appears in an ACL and in access lists associated with forms, views, fields, or sections.

>
			 3 2 0 0 0 0 0 1 0 0 0 0
<:s><-">The access level in the ACL takes precedence over the access list.  For example, if users have Reader access in the ACL, then they still can't create documents even if they are included in an access list that allows this. 

@See also prnt@
>
		[e]
	[tble]
[frm]
	13
	1573060
	960
	2520
	9446
	6245
	0
	1
	1
	1 0 0 0 0 0 0
	0
	16777215
	13
	1
	0
	0 2048
	[frmlay]
		8882
		8486
		1
		0
		0
		1
		2520
		0
		0
		2
		0
		1
		1
		0
		1
		1104
		10836
		0
	[tbl]
		 7 3 0 86 5169 86 1 43 43
		[h]
			 0 220 86 2 0 2 0
			 1 440 86 2 0 1 0
			 2 220 86 2 0 2 0
			 3 660 86 2 0 1 0
			 4 660 86 2 0 1 0
			 5 660 86 2 0 1 0
			 6 220 86 2 0 2 0
		[e]
		[w]
			 0 1440 86 2 0
			 1 1384 216 6 0
			 2 6165 216 6 0
		[e]
		[data]
			 0 1 0 0 0 0 0 1 0 0 0 0
<+!>Access Level<-!>

>
			 0 2 0 0 0 0 0 1 0 0 0 0
<+!>Users assigned to the level<-!>

>
			 1 1 0 0 0 0 0 1 0 0 0 0
Manager

>
			 1 2 0 0 0 0 0 1 0 0 0 0
Fred Haynes, the manager of Customer Support

Kim Hoang, the manager of Field Support Engineers

>
			 2 1 0 0 0 0 0 1 0 0 0 0
Designer

>
			 2 2 0 0 0 0 0 1 0 0 0 0
Carol Klein, an ISS developer

>
			 3 1 0 0 0 0 0 1 0 0 0 0
Editor

>
			 3 2 0 0 0 0 0 1 0 0 0 0
<:s>CS Supervisors

A group of Customer Support supervisors (defined in the Name & Address Book) who can change information provided by customer support representatives. 

>
			 4 1 0 0 0 0 0 1 0 0 0 0
Author

>
			 4 2 0 0 0 0 0 1 0 0 0 0
-Default-

Anybody not restricted to Reader access can create documents. A role defines who can create Announcement documents.

>
			 5 1 0 0 0 0 0 1 0 0 0 0
Reader

>
			 5 2 0 0 0 0 0 1 0 0 0 0
<:s>CS Trainees

A group of new Customer Support employees who are currently in training and not yet qualified to respond to customer questions.

>
			 6 1 0 0 0 0 0 1 0 0 0 0
No Access

>
			 6 2 0 0 0 0 0 1 0 0 0 0
No entries.

>
		[e]
	[tble]
[frm]
	12
	1573060
	720
	960
	9206
	7321
	0
	1
	1
	1 0 0 0 0 0 0
	0
	16777215
	12
	2
	0
	475 0
	[frmlay]
		5233
		8486
		1
		0
		0
		1
		960
		0
		0
		2
		0
		117
		98
		26988
		1
		1344
		11616
		0
	[tbl]
		 7 3 0 86 5169 86 1 43 43
		[h]
			 0 221 86 2 0 2 0
			 1 1266 86 2 0 1 0
			 2 1055 86 2 0 1 0
			 3 844 86 2 0 1 0
			 4 844 86 2 0 1 0
			 5 853 86 2 0 1 0
			 6 633 86 2 0 1 0
		[e]
		[w]
			 0 1440 86 2 0
			 1 1352 63 6 0
			 2 5405 216 6 0
		[e]
		[data]
			 0 1 8 0 0 0 0 1 0 0 0 0
<+@><:I0,0,0,0><:S+-1><+!><:f180,BArial,0,0,0>Access level<:f>

>
			 0 2 8 0 0 0 0 1 0 0 0 0
<+@><:I0,0,0,0><:S+-1><+!><:f180,BArial,0,0,0>Users assigned to the level<-!><:f>

>
			 1 1 8 0 0 0 0 1 0 0 0 0
<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Manager<:f>

>
			 1 2 8 0 0 0 0 1 0 0 0 0
<+@><:s><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Peter Thomas, the d<:f><:f180,BArial,0,0,0>irector of Human Resources,

<+@><:s><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Kimberly Allen, the a<:f><:f180,BArial,0,0,0>dministrative assistant to the d<:f><:f180,BArial,0,0,0>irector of Human Resources

<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Jane Hollings, the m<:f><:f180,BArial,0,0,0>anager of the Benefits Department

<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Marcy Hoag, the c<:f><:f180,BArial,0,0,0>hai<:f180,BArial,0,0,0>rperson of the compensation committee

<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Each user is located at company headquarters.<:f>

>
			 2 1 8 0 0 0 0 1 0 0 0 0
<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Designer<:f>

>
			 2 2 8 0 0 0 0 1 0 0 0 0
<+@><:s><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>None

<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>The ISS programmer who designed the database<:f180,BArial,0,0,0> 
<:f180,BArial,0,0,0>no longer has Designer access due <:f180,BArial,0,0,0>to<:f180,BArial,0,0,0> 
<:f180,BArial,0,0,0>the confidential nature of the database. A<:f180,BArial,0,0,0> manager gives the designer<:f180,BArial,0,0,0> access as needed when design changed are required.<:f>

>
			 3 1 0 0 0 0 0 1 0 0 0 0
Editor

>
			 3 2 8 0 0 0 0 1 0 0 0 0
<+@><:s><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Human Resource, <:f><:f180,BArial,0,0,0>Field Managers

<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Two groups (defined in the Name & Address Book) that include managers of individual human resource 
<:f180,BArial,0,0,0>departments and branch managers of all field offices. They can delete documents.<:f>

>
			 4 1 0 0 0 0 0 1 0 0 0 0
Author

>
			 4 2 8 0 0 0 0 1 0 0 0 0
<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Field Supervisors, Field AAs

<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Two <:f180,BArial,0,0,0>groups (defined in the Name & Address Book) that contribute most of the 
<:f180,BArial,0,0,0>data to the database. Field Supervisors can delete documents; Field AAs cannot.<:f>

>
			 5 1 0 0 0 0 0 1 0 0 0 0
Reader

>
			 5 2 0 0 0 0 0 1 0 0 0 0
<:s><:f,BArial,>AP Payroll

<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>A <:f180,BArial,0,0,0>group of users (defined in the Name & Address book) from Accounts Payable who sometimes<:f180,BArial,0,0,0> need to check the current status of employees, but do not need to create documents.<:f>

>
			 6 1 0 0 0 0 0 1 0 0 0 0
No Access

>
			 6 2 8 0 0 0 0 1 0 0 0 0
<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>-Default-

<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Given the confidential <:f180,BArial,0,0,0>nature of 
<:f180,BArial,0,0,0>this database<:f180,BArial,0,0,0>, n<:f180,BArial,0,0,0>o one else at Pagano Industries has access to the database.<:f>

>
		[e]
	[tble]
[frm]
	11
	1573060
	960
	960
	9255
	5451
	0
	1
	1
	1 0 0 0 0 0 0
	0
	16777215
	11
	3
	17
	0 36864
	[frmlay]
		6134
		8295
		1
		0
		0
		1
		960
		0
		0
		2
		0
		109
		112
		28271
		1
		1344
		11616
		0
	[tbl]
		 7 3 0 86 5171 86 1 43 43
		[h]
			 0 221 86 2 0 2 0
			 1 422 86 2 0 1 0
			 2 633 86 2 0 1 0
			 3 844 86 2 0 1 0
			 4 844 86 2 0 1 0
			 5 633 86 2 0 1 0
			 6 1064 86 2 0 1 0
		[e]
		[w]
			 0 1440 86 2 0
			 1 1367 216 6 0
			 2 4927 216 6 0
		[e]
		[data]
			 0 1 8 0 0 0 0 1 0 0 0 0
<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0><+!>Access Level<:f>

>
			 0 2 8 0 0 0 0 1 0 0 0 0
<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0><+!>Users assigned to the level<-!><+!><:f>

>
			 1 1 8 0 0 0 0 1 0 0 0 0
<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Manager<:f>

>
			 1 2 8 0 0 0 0 1 0 0 0 0
<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Hannah Moutal, the m<:f><:f180,BArial,0,0,0>anager of MIS developers

<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Maryanne Burns, the Notes administrator for MIS 
<:f>

>
			 2 1 8 0 0 0 0 1 0 0 0 0
<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Designer<:f>

>
			 2 2 8 0 0 0 0 1 0 0 0 0
<+@><:s><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>None

<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>All design maintenance is done using the design template on another server<:f><:f180,BArial,0,0,0> dedicated to 
<:f><:f180,BArial,0,0,0>application development.<:f>

>
			 3 1 8 0 0 0 0 1 0 0 0 0
<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Editor<:f>

>
			 3 2 8 0 0 0 0 1 0 0 0 0
<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>MIS d<:f><:f180,BArial,0,0,0>evelopers

<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>A g<:f><:f180,BArial,0,0,0>roup of users (defined in the Name & Ad<:f><:f180,BArial,0,0,0>dress Book)<:f><:f180,BArial,0,0,0> responsible 
<:f><:f180,BArial,0,0,0>for creating D<:f><:f180,BArial,0,0,0>esign S<:f><:f180,BArial,0,0,0>pecs and editing those of others<:f><:f180,BArial,0,0,0>.<:f>

>
			 4 1 8 0 0 0 0 1 0 0 0 0
<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Author<:f>

>
			 4 2 8 0 0 0 0 1 0 0 0 0
<+@><:s><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Section h<:f><:f180,BArial,0,0,0>eads

<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>A <:f><:f180,BArial,0,0,0>group of users (defined in the Name & Address Book) with the authority 
<:f><:f180,BArial,0,0,0> to <:f><:f180,BArial,0,0,0>create Application Requests and<:f><:f180,BArial,0,0,0> Application Change Requests<:f><:f180,BArial,0,0,0>.<:f>

>
			 5 1 8 0 0 0 0 1 0 0 0 0
<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>Reader<:f>

>
			 5 2 8 0 0 0 0 1 0 0 0 0
<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>-Default-

<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>All users not assigned to other access levels<:f><:f180,BArial,0,0,0> can read documents if they have access to the server.<:f>

>
			 6 1 8 0 0 0 0 1 0 0 0 0
<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>No Access<:f>

>
			 6 2 8 0 0 0 0 1 0 0 0 0
<+@><:s><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>No entries

<+@><:I0,0,0,0><:S+-1><:f180,BArial,0,0,0>All users can access the database as long as they have access to the server.  Entries for this access level could<:f><:f180,BArial,0,0,0> be included in the future should 
<:f><:f180,BArial,0,0,0>server resources become limited. <:f>

>
		[e]
	[tble]
[lay]
	Standard
	3079
	[rght]
		12960
		10166
		1
		960
		1200
		3
		960
		720
		0
		1
		0
		1
		0
		2
		1
		960
		9446
		1
		1
		3120
	[lft]
		12960
		10166
		1
		720
		1200
		3
		960
		960
		0
		1
		0
		1
		0
		2
		1
		720
		9206
		1
		1
		3120
	[hlft]
	[lyfrm]
		1
		3008
		0
		0
		10166
		960
		0
		1
		3
		1 0 0 0 0 0 0
		0
		0
		3
	[frmlay]
		960
		10166
		1
		720
		180
		3
		0
		960
		0
		1
		0
		1
		1
		0
		1
		720
		9206
		1
		2
		4674
	[txt]
>
	[hrght]
	[lyfrm]
		1
		11200
		0
		0
		10166
		960
		0
		1
		3
		1 0 0 0 0 0 0
		0
		0
		1
	[frmlay]
		960
		10166
		1
		960
		180
		3
		0
		720
		0
		1
		0
		1
		1
		0
		1
		960
		9446
		1
		2
		4674
	[txt]

>
	[flft]
	[lyfrm]
		1
		5056
		0
		11760
		10166
		12960
		0
		1
		3
		1 0 0 0 0 0 0
		0
		0
		4
	[frmlay]
		12960
		10166
		1
		720
		480
		3
		11940
		960
		0
		1
		0
		1
		1
		0
		1
		720
		9206
		1
		3
		9900
	[txt]
<:P19999,0,3->  Database Manager's Guide                                        Lotus Confidential

>
	[frght]
	[lyfrm]
		1
		13248
		0
		11760
		10166
		12960
		0
		1
		3
		1 0 0 0 0 0 0
		0
		0
		2
	[frmlay]
		12960
		10166
		1
		960
		480
		3
		11940
		720
		0
		1
		0
		1
		1
		0
		1
		960
		9446
		1
		3
		9900
	[txt]
<:R1,5,1,480,1,960,1,1440,1,1920,1,4080,>Lotus Confidential                                Controlling Access to a Database 
<:P19999,0,3->

>
[elay]
[l1]
	0
[pg]
	20
	12 128 13 32 0 0 0 240 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 0 0 0
	27 72 163 32 0 0 0 240 215 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 0 0 0
	41 0 5 0 0 0 0 240 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 3 0 0
	53 242 91 32 0 0 0 240 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 0 0 0
	67 309 60 0 0 0 0 240 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 0 0 0
	85 0 5 0 0 0 0 240 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 0 0 0
	105 0 69 0 0 0 0 240 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 0 0 0
	134 0 21 0 0 0 0 240 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 0 0 0
	156 162 80 0 0 0 0 240 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 0 0 0
	171 0 5 0 0 0 0 65535 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 2 0 0
	182 145 39 0 0 0 0 240 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 0 0 0
	191 0 80 0 0 0 0 240 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 0 0 0
	205 0 30 0 0 0 0 240 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 0 0 0
	233 0 9 0 0 0 0 240 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 0 0 0
	257 165 57 32 0 0 0 240 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 0 0 0
	275 84 13 32 0 0 0 240 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 0 0 0
	292 0 5 32 0 0 0 240 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 0 0 0
	316 0 24 32 0 0 0 240 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 0 0 0
	331 160 38 0 0 0 0 240 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 0 0 0
	351 0 0 1025 0 0 0 240 65535 Standard	65535 0 0	0 0 0 0 0 0 0 65535 0 0 65535 0 0 0 0 0
[edoc]
@Chapter title@<:s><:#1004,8486><:f280,BArial,0,0,0><+!>Chapter 3<-!><:f><+!><:f280,BArial,0,0,0> 
<:f><:f280,BArial,0,0,0>Controlling Access to a Database<-!><:f>

<:s><:#480,8486><-!><-"><-!><-">This chapter describes access levels as they apply to users and provides instructions for defining an ACL. 

@Ahead@<:s><:#390,8486>About the Access Control List

<:s><:#1440,8486>Every database includes an Access Control List (ACL) which Notes uses to determine the level of access that users and servers have to a database. Although the names of access levels are the same for users and servers, those assigned to users determine the t
asks that user can perform on a database while those assigned to servers determine what information within the database the servers can replicate. 
<:X8,1;Index "ACL" # "defined">

<:s><:#720,8486>Database managers and designers should work together to determine the ACL requirements for a database. Only a someone with Manager access can create the ACL.

<:s><:#720,8486>Once you create an ACL, you can create one or more roles that you or the designer can then use to refine access to particular views, forms, sections, or fields of a database.

@See also prnt@<:s><:#240,8486>For information on creating roles, see "About roles and refining database access."

@See also prnt@<:s><:#480,8486>For a description of access levels as they apply to replication, see "About server access levels and replication" in Chapter 4.

@See also btn@<:s><:#240,8486><:N798415855,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Ahead@<:s><:#390,8486>About access levels for users

<:s><:#720,8486>Access levels assigned to users in a database ACL control which tasks (if any) users can perform on that database. The access levels, from highest to lowest, as they apply to users are as follows: 

@Note@<:s><:#720,8486>Users must have access to a Notes server in order to access databases on the server. See the Administrator's Guide<+"> 
<-">for more information. 

@Bhead@<:s><:#260,8486>Manager

<:s><:#1200,8486>Users with Manager access can modify ACL settings, modify replication settings, encrypt a database for local security, and delete a database--tasks permitted by no other access level.  Managers can also perform all tasks allowed by other access levels. Note
s requires each database to have at least one Manager. It's best to assign two people Manager access to a database in case one manager is absent. 
<:X8,2;Index "Manager access" # "assigning to people"> <:X8,2;Index "Access levels" # "Manager">

@Bhead@<:s><:#260,8486>Designer

<:s><:#1440,8486>Users with Designer access can modify all database design elements including fields, forms, views, public agents, the database icon, Using This Database document, About This Database document, and can create a full text index. Designers can also perform all
 tasks allowed by lower access levels. Assign Designer access to the original designer of a database or to a user responsible for updating the design after a database is in use.<:X8,2;Index "Designer access" # "assigning to people"> 
<:X8,2;Index "Access levels" # "Designer">

@Bhead@<:s><:#260,8486>Editor

<:s><:#720,8486>Users assigned Editor access can create documents and edit all documents, including those composed by others. Assign Editor access, for example, to a user responsible for maintaining all data in a database.<:X8,2;Index "Editor access" # "assigning to people">
 <:X8,2;Index "Access levels" # "Editor">

@Bhead@<:s><:#260,8486>Author

<:s><:#720,8486>Users assigned Author access can create documents and edit documents they create. Assign Author access to allow users to contribute to a database but not edit documents created by others. 
<:X8,2;Index "Author access" # "assigning to people"> <:X8,2;Index "Access levels" # "Author">

<:s><:#480,8486>When possible, use Author access rather than Edit access to reduce Replication or Save Conflicts.

@See also prnt@<:s><:#240,8486>For more information on Replication or Save Conflicts, see Chapter 4. 

@Bhead@<:s><:#260,8486>Reader

<:s><:#720,8486>Users assigned Reader access can read documents in a database but cannot create or edit documents.	For example, assign Reader access to users who must be able to read the contents of a reference database such as a company policies database. 
<:X8,2;Index "Reader access" # "assigning to people"> <:X8,2;Index "Access levels" # "Reader">

<:s><:#960,8486>Anyone with at least Reader access to a database can create private agents in the database. However, users can only run agents that perform tasks allowed by their access levels. For example, someone with Reader access can create a private agent that deletes
 documents, but the agent won't delete documents when the user runs it.

@Bhead@<:s><:#260,8486>Depositor

<:s><:#1200,8486>Users assigned Depositor access can create documents but can't read any documents, even the ones they create. 
<:f180,BArial,0,0,0>For example,<:f><:f180,BArial,0,0,0> a<:f><:f180,BArial,0,0,0>ssign Depositor access 
<:f><:f180,BArial,0,0,0>to allow users to contribute to a mail-in database or to a database used as a ballot box.<:f> 
<:X8,3;Index "Depositor access" # "assigning to people"> <:X8,3;Index "Access levels" # "Depositor">

@Bhead@<:s><:#260,8486>No Access

<:s><:#480,8486>Users assigned No Access cannot access the database. For example, assign No Access to users to prevent them from accessing a confidential database. 
<:X8,3;Index "No Access" # "assigning to people"> <:X8,3;Index "Access levels" # "No Access">

@Note@<:s><:#1200,8486>Users with Depositor or No Access to a database may be able to copy the database outside of Notes through the operating system. Notes administrators can prevent this by keeping the Notes server physically secure. A database manager can also encrypt the data
base through the local security option so that the database is illegible even when copied.

@See also btn@<:#240,8486>{bmc 1details.bmp}See examples

@See also btn@<:s><:#240,8486><:N798415855,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@See also btn@<:s><:#240,8486>About access levels for servers 

@See also btn@<:s><:#240,8486>Assigning an access level to a name in the ACL  <:N798416298,KB,65535,2,1
@@EndSection

>

@Ahead@<:s><:#390,8486>About access levels for servers

<:s><:#960,8486>If there are replicas of a database, make sure to add server names in the replica ACLs since server access levels affect what information can be exchanged between the replica databases. If there are no replicas of a database, it is not necessary to include 
server names in the database ACL. 

@See also prnt@<:s><:#240,8486>For more information, see "About assigning server access levels" in Chapter 4.

@See also btn@<:s><:#240,8486><:N798415855,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Ahead@<:s><:#390,8486>About names assigned more than one access level

<:s><:#720,8486>It's possible to assign users or servers more than one level of access to a database. The following table describes the situations in which this can happen and how Notes resolves the conflicts.<:X8,3;Index "ACL" # "resolving conflicting access in"> 
<:X8,3;Index "Access levels" # "resolving conflicting"> <:X8,3;Index "Conflicts" # "ACL">

<:s><:I0,0,0,26><:t0>

@See also prnt@<:s><:#480,8486>For information on creating access lists that refine access to specific database components, see the Application Developer's Guide.

@See also btn@<:s><:#240,8486><:N798415855,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Ahead@<:s><:#390,8486>About acceptable entries in an ACL

<:s><:#240,8486>Notes permits the following types of entries in an ACL:<:X8,4;Index "ACL" # "acceptable entries in">

@Bhead@<:s><:#260,8486>Names of users

<:s><:#1920,8486>You can add the names of any individuals with certified Notes IDs to an ACL. If a name is not in the public Name & Address Book of the server on which the database resides, you must spell out the exact user name; for example, if Bob White's user name is Rob
ert J. White,  then you must enter "Robert J. White." If a user's name is included in the Name & Address Book, then you can use the spelling shown there; for example, if the Person record for Robert J. White lists "Bob White" as a short name, then you can e
nter "Robert J. White" or "Bob White."

@Bhead@<:s><:#260,8486>Names of servers

<:s><:#480,8486>You add server names to an ACL to control what changes a database receives from replicas of the database on those servers. 

@See also prnt@<:s><:#240,8486>For more information, see "About Assigning Server Access Levels" in Chapter 4.

<:s><:#960,8486>Servers listed in an ACL must be included in the Name & Address Book of the server on which the database resides or in the Name & Address Book of another domain.  Make sure to spell server names exactly as they appear in the Name & Address Book server docum
ent. <:X8,4;Index "ACL" # "adding server names to">

@Bhead@<:s><:#260,8486>Names of groups 

<:s><:#960,8486>You can add a group to an ACL to represent multiple users and/or servers that require the same access. Any group listed in an ACL must exist in a public Name & Address book;<-!> if you want to create a new group for inclusion in an ACL, have a Notes adminis
trator add it or add it yourself to the public Name & Address book. 
<:X8,4;Index "ACL" # "using groups in"><:X8,4;Index "Groups" # "advantages to using in ACL">

<:s><:#720,8486>Use individual names rather than group names for the managers of a database; when users choose Create - Memo to Manager, they'll know who they are addressing. 

<:s><:#240,8486>Using a group in the ACL offers the following advantages:

@Bullet@<:s><:#960,8486>If you need to change the access level for several users or servers, you can do so once for the entire group. If a group is listed in more than one ACL, you can modify the list of members from a central location (the Name & Address Book) rather than adding 
and deleting names in multiple databases.

@Bullet@<:s><:#1440,8486>You can use groups to let certain users control access to the database without letting them change the design. For example, you or a Notes administrator can create groups in the Name & Address Book for each level of database access needed, add the groups to
 an ACL, and allow specific users to own the groups; if these users don't have Manager access in the ACL, they can't modify the design of the database. 

@Bullet@<:s><:#480,8486>Group names can reflect the responsibilities of group members or the organization of a department or company.  

@Note@<:s><:#480,8486>A nested group (a group within a group) cannot use a user's short name, but must use the name as it appears in the Notes ID. 

@Chead@<:#240,8486>Terminations group 

<:#1200,8486>When employees leave an organization, a Notes administrator should remove their names from all groups in the Name & Address Book and add them to the group used for terminations. As a database manager, you should remove the names of terminated employees from
 the ACLs of all databases you manage. Make sure you add the terminations group to the ACLs and that you assign the group No Access. 
<:X8,5;Index "Terminations group" # "using"><:f,,><:X8,5;Index "Groups" # "terminations">

<:s><:#480,8486><:f,,>A Notes administrator can use an administration agent on a server to automate this process and automatically remove names from the ACL.<:f>

@See also prnt@<:s><:#480,8486>For m<:f,,>ore information on automatic ACL updates, see "About using a server agent to update the ACL" later in this chapter.<:f>

@Bhead@<:s><:#260,8486>Replica IDs

<:#720,8486>You can let an agent from another database use @DbColumn or @DbLookup to retrieve data from a database you manage by including the replica ID of the other database in the ACL of your database.

@Bullet@<:s><:#240,8486>The two databases must be located on the same server or workstation.

@Bullet@<:#1200,8486>The retrieving database must have at least Reader access to your database. You can provide this access by adding the replica ID of the other database in your database ACL and assigning it Reader access or higher.  If you do not add the replica ID to the ACL
, the other database can still retrieve data if the -Default- access level of your database is Reader or higher.

@Bullet@<:#960,8486>To determine the replica ID of a database, choose File - Database - Properties and select Replication.  A replica ID looks like this:  85255B42:005A8FA4. You can type the replica ID in uppercase or lowercase characters. Do not enclose the replica ID in quot
ation marks.  

<:s><:#240,8486><-!><:f180,BArial,0,0,255><+!>Still true for R4? <-!><:f>

@See also btn@<:s><:#240,8486><:N798415855,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Ahead@<:s><:#390,8486>About using hierarchical names in the ACL

<:s><:#240,8486><:f180,BArial,0,0,255><+!><+">CORRECT FOR R4?<-"><-!><:f>

<:s><:#960,8486>If your organization uses hierarchical names, you can use them for users, servers, and groups in the ACL. Doing so provides tighter security, especially for databases that replicate widely. Make sure the<:X8,6;Index "ACL" # "using distinguished names in"><:X8,6;Index "Distinguished names" # "using in ACL">
<:X8,6;Index "Hierarchical names" # "using in ACL" > hierarchical name listed in the ACL exactly matches the hierarchical name in the public Name & Address Book.

<:#1200,8486>If you use a non-hierarchical user name in an ACL, it matches any non-hierarchical name with the same first and last names and matches any hierarchical user name with the same common name component.  For example, if the ACL lists "Mary Tsen,"  then "Mary Ts
en,"  "Mary Tsen/Illustration" and "Mary Tsen/Finance" all receive the chosen level of database access.  

<:s><:#480,8486>Use non-hierarchical names for users and servers that use Release 2 or earlier or who have not had their IDs upgraded to hierarchical format. 

@See also prnt@<:s><:#240,8486>See the <+">Administrator's Guide<-"> for more information about hierarchical names

@Bhead@<:#260,8486>Wildcards and hierarchical names

<:#1200,8486>To generalize access to a database, you can use hierarchical names with a wildcard character (*) in  the ACL. You can use wildcards in the Common Name component and in the Organizational Units. Notes assigns the chosen access level to all users or servers w
hose hierarchical names include the components that don't contain a wildcard.<-!> 
<:X8,6;Index "Wildcards" # "using in distinguished names" >

<:s><:#240,8486>For example, the ACL entry

<:s><:#480,8486>CN=*/OU=Illustration/OU=Production/O=WorkSavers/C=US grants the chosen access level to:

<:s><:#240,8486>Mary Tsen/Illustration/Production/WorkSavers/US

<:s><:#240,8486>Michael Bowling/Illustration/Production/WorkSavers/US

<:s><:#240,8486>but not to:

<:s><:#240,8486>Sandy Braun/Documentation/Production/WorkSavers/US

@See also btn@<:s><:#240,8486><:N798415855,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Ahead@<:s><:#390,8486>About default entries in the ACL 

<:s><:#480,8486><-"><-!>When you create a new database Notes automatically supplies the following entries in the ACL: 
<:X8,7;Index "ACL" # "default entries in"> <:X8,7;Index "Default entries" # "in ACL">

@Bullet@<:#240,8486>-Default- 

@1st lev para@<:#1920,8486><-!><-">Users or servers receive the access assigned to the -Default- group if not specifically assigned another access level, either individually or as a member of a group. The access level you assign to the -Default- group depends on how secure you want t
he database to be. If you want a database available to a limited number of users, select No Access. To make a database available for general use, select Author or Reader access. You cannot delete the -Default- group from an ACL. The -Default- group is the o
nly group that is specific to a database and not related to a group in the Name & Address Book. 
<:X8,7;Index "Default group in ACL" #><:X8,7;Index "Groups" # "-Default-"><:f><:X8,7;Index "ACL" # "using -Default- group in">

@Bullet@<:s><:#240,8486>Database creator<+!> <-!>

@1st lev para@<:s><:#240,8486>This is the name of the user who created the database.

@Bullet@<:#240,8486>LocalDomainServers 

@1st lev para@<:s><:#720,8486>This is a group provided with every public Name & Address Book. The group includes the servers in the same domain as the server on which the database is stored. 
<:X8,7;Index "LocalDomainServers group in ACL" #><:X8,7;Index "Groups" # "LocalDomainServers"> 
<:X8,7;Index "ACL" # "using LocalDomainServers group in"> <-!><-!>

@Bullet@<:#240,8486>OtherDomainServers <:X8,7;Index "OtherDomainServers group in ACL" #><:X8,7;Index "Groups" # "OtherDomainServers"><:X8,7;Index "ACL" # "using OtherDomainServers group in">

@1st lev para@<:s><:#720,8486>This is a group provided with every public Name & Address Book. The group includes the servers outside the domain of the server on which the database is stored. 

@See also prnt@<:#720,8486>For more information on the LocalDomainServers and OtherDomainServers groups and their impact on replication, see "About using server groups in the ACL" in Chapter 4.

@See also btn@<:s><:#240,8486><:N798415855,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

<:s><:#240,8486>

@Ahead@<:s><:#390,8486>Ways to add a name to the ACL

<:s><:#240,8486>You can add a name to the ACL by:

@Bullet@<:s><:#240,8486>Selecting a name from a Name & Address Book  

@Bullet@<:s><:#240,8486>Typing a name 

@See also btn@<:s><:#240,8486><:N798418569,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Bhead title@<:s><:#260,8486>Adding a name to the ACL by selecting from a Name & Address Book

@Numbered list@<:s><:#240,8486>Select the database icon and choose File - Database - Access Control.

@Numbered list@<:s><:#240,8486>Click Add.

@Numbered list@<:s><:#240,8486>Click the drop-down arrow and select a Name & Address Book.

@Numbered list@<:s><:#240,8486>Select the name of a person, server, or group from the Name & Address book.

@Numbered list@<:s><:#480,8486>(Optional) Click Open to read the Name & Address Book document for the selected name and then click Close when you are finished.

@Numbered list@<:s><:#480,8486>(Optional) Click "Copy to Local Address Book" to copy a name selected in a public Name & Address Book to your local address book.

@Numbered list@<:s><:#240,8486>Click Add.

@Numbered list@<:s><:#240,8486>Repeat steps 4 - 8 to add additional names from the Name & Address Book.

@Numbered list@<:s><:#480,8486>(Optional) <:ZDDE_BOOKMARK2>To remove a name you've just added, select the name and click Remove. To remove all names you've just added, click Remove All.<:Z~DDE_BOOKMARK2>

@Numbered list@<:s><:#240,8486>Click OK.

@See also btn@<:s><:#240,8486><:N798420789,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Bhead title@<:s><:#260,8486>Adding a name to the ACL by typing it

@Numbered list@<:s><:#240,8486>Select the database icon and choose File - Database - Access Control.

@Numbered list@<:s><:#240,8486>Click Add.

@Numbered list@<:s><:#240,8486>Click New.

@Numbered list@<:s><:#240,8486>Type the exact name of a user, server, or group then click OK.

@Numbered list@<:s><:#240,8486>Repeat steps 3 - 4 for each additional name to add.

@Numbered list@<:s><:#480,8486>(Optional) To remove a name you've just added, select the name and click Remove. To remove all names you've just added, click Remove All.

@Numbered list@<:s><:#240,8486>Click OK.

@See also btn@<:s><:#240,8486><:N798420789,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Bhead title@<:s><:#260,8486>Assigning an access level to a name in the ACL

@Numbered list@<:s><:#480,8486>Select the database icon and choose File - Database - Access Control (if the Access Control List isn't already open).

@Numbered list@<:s><:#240,8486>Select a name under "People, Servers, Groups."

@Numbered list@<:s><:#240,8486>Click the drop-down arrow in the Access level box and select an access level.

@Numbered list@<:s><:#240,8486>Select or deselect the following options if available:

@1st lev para@<:s><:#240,8486>Create documents

@1st lev para@<:s><:#240,8486>Delete documents

@1st lev para@<:s><:#240,8486>Create personal agents

@1st lev para@<:s><:#240,8486>Create personal folders

@1st lev para@<:s><:#240,8486>Create shared folders

@1st lev para@<:s><:#240,8486>Create LotusScript

@Numbered list@<:s><:#240,8486>Repeat steps 2 - 4 to assign access levels to other names.

@Numbered list@<:s><:#240,8486>Click OK.

@Note@<+@><:s><:S+-1><:#480,8486>All Access Control Lists must include at least one name assigned Manager access.

@See also btn@<:#240,8486>{bmc 1details.bmp}See details 

@See also btn@<:#240,8486>{bmc 1details.bmp}See examples 

@See also btn@<:s><:#240,8486><:N798420789,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Chead title@<:s><:#240,8486>Details: <:f180,BArial,0,0,0><+!>Assigning an access level to a name in the ACL<-!><:f>

@Dhead@<:s><:#240,8486><+!>C<-!><+!>reate documents<-!>

<:s><:#480,8486>Select this option to allow Managers, Designers, Editors, or Authors to create documents.

@Dhead@<:s><:#240,8486><+!>D<-!><+!>elete documents<-!> 

<:s><:#480,8486>Select this option to allow Managers, Designers, Editors, or Authors to delete documents. By default, nobody can delete documents (even their own). 

<:s><:#720,8486>For larger applications, it's generally good practice to prevent users from deleting documents so that server resources aren't spent generating and replicating deletion stubs. 
<:X8,9;Index "Delete documents option" # "using in ACL">

@Dhead@<:s><:#240,8486>Create Personal Agents

<:s><:#480,8486>Select this option to allow users with Reader, Author, Editor, or Designer to create personal agents. (Managers are always given this access.)

<:s><:#720,8486>Since personal agents on server databases take up server disk space and processing time, you may want to deselect this option to prevent some users from creating them.

@Note@<:s><:#720,8486>A Notes administrator can prevent people from running personal agents on a server; people denied this server access can't create personal agents on the server, regardless of the ACL setting.

@Dhead@<:s><:#240,8486>Create personal folders and views

<:s><:#1200,8486>By default, anybody with Reader access or higher can create personal folders and views in a database on a server. You can deselect this option for people with Reader, Author, Editor, or Designer access; they can still create personal folders and views but t
he views and folders are stored on their local workstations. Choose this option to save disk space on a server. 

<:s><:#240,8486>This option is permanently selected for Managers.

@Dhead@<:s><:#240,8486>Create shared folders and views

<:s><:#1200,8486>By default, anybody with Editor access or higher can create shared folders and views. You can deselect this option to save disk space on a server and to maintain tighter control over database design. Managers can always create shared folders and views.<-!><-">
 <:f180,BArial,0,0,255><+!><+">Since you'd only want to give this access judiciously, why is the default to give the access? 
<-"><-!><:f>

@Dhead@<:s><:#240,8486>Create LotusScript

<:s><:#720,8486>Select this option to allow anybody with Author access or higher to create LotusScript agents. 
<:f180,BArial,0,0,255><+!><+">Does this access place any limitations on the scripts you can create? 
<-"><-!><:f>

<:s><:#720,8486>Since LotusScript agents on server databases have the potential to take up significant server processing time, you may want to restrict which users can create them.

@Note@<:s><:#720,8486>A Notes administrator can prevent people from running LotusScript agents on a server; people denied this server access can't create LotusScript agents regardless of the ACL setting.

<:s><:#240,8486>

@Chead title@<:s><:#240,8486><:f180,BArial,0,0,0><+!>Examples: Assigning an access level to a name in the ACL<-!><:f>

@Dhead@<:s><:#240,8486>Example 1: an application tracking database

<+@><:S+-1><:#1266,8486><:f180,BArial,0,0,0>Lu & Ramsey is a small consulting firm that uses Notes for many<:f><:f180,BArial,0,0,0> of its daily business activities. The company's<:f><:f180,BArial,0,0,0> Management Information Services (MIS) group<:f><:f180,BArial,0,0,0> is respon
sible for developing and maintaining company-wide Notes applications as well as applications for use only by specific departments. 
<:f><:f180,BArial,0,0,0>MIS uses t<:f><:f180,BArial,0,0,0>he Application Tracking database 
<:f><:f180,BArial,0,0,0>to<:f><:f180,BArial,0,0,0> inform all employees of the status of 
<:f><:f180,BArial,0,0,0>applications <:f><:f180,BArial,0,0,0>under development and to provide a list of 
<:f><:f180,BArial,0,0,0>applications already in production<:f><:f180,BArial,0,0,0>.<:f>

<+@><:s><:S+-1><:#211,8486><:f180,BArial,0,0,0>There are four types of documents in the Application Tracking d<:f><:f180,BArial,0,0,0>atabase.<:f>

<+@><:s><:S+-1><:#643,8486><+!><:f180,BArial,0,0,0>Application Fact Sheet<-!> - A<:f><:f180,BArial,0,0,0> main document that describes an<:f><:f180,BArial,0,0,0> application currently in production 
<:f><:f180,BArial,0,0,0>and<:f><:f180,BArial,0,0,0> provides <:f><:f180,BArial,0,0,0>information<:f><:f180,BArial,0,0,0> such as 
<:f><:f180,BArial,0,0,0>the<:f><:f180,BArial,0,0,0> title, file name, production date, manager, and server locations.

<+@><:s><:S+-1><:#643,8486><+!><:f180,BArial,0,0,0>Application Request <-!>- A<:f><:f180,BArial,0,0,0> main document that consists of two sections, 
<:f><:f180,BArial,0,0,0>one section <:f><:f180,BArial,0,0,0>containing<:f><:f180,BArial,0,0,0> an application request and another<:f><:f180,BArial,0,0,0> used by the design department that lists<:f><:f180,BArial,0,0,0> the assigned designer and estimated co
mpletion date.

<+@><:s><:S+-1><:R1,1,1,360,><:#432,8486><+!><:f180,BArial,0,0,0>Design Spec<-!> - A<:f><:f180,BArial,0,0,0> response document associated with a request for application that 
<:f><:f180,BArial,0,0,0>describes in detail the planned application.

<+@><:s><:S+-1><:R1,1,1,360,><:#432,8486><+!><:f180,BArial,0,0,0>Application Change Request <-!>- A<:f><:f180,BArial,0,0,0> response document associated with a request for application.<:f>

<+@><:S+-1><:R><:#451,8486><:f180,BArial,0,0,0>The following table describes the <:f><:f180,BArial,0,0,0>access levels assigned 
<:f><:f180,BArial,0,0,0>to users for the <:f><:f180,BArial,0,0,0>database on the main MIS production server.<:f>  

<+@><:s><:S+-1><:t3>

@Bhead@<+@><:s><:S+-1><:#221,8486><:f180,BArial,0,0,0>Roles assigned to the database

<+@><:s><:S+-1><:#211,8486><:f180,BArial,0,0,0>No roles are assigned to this database.<:f>

@Dhead@<+@><:s><:S+-1><:#221,8486><:f180,BArial,0,0,0>Example 2: a Human Resources database<:f>

<+@><:S+-1><:#422,8486><:f180,BArial,0,0,0>Pagano Industries is a company based <:f><:f180,BArial,0,0,0>in San Francisco. The company has<:f><:f180,BArial,0,0,0> 
<:f><:f180,BArial,0,0,0>sales and service offices in the<:f><:f180,BArial,0,0,0> U.S. and Canada.<:f>

<+@><:s><:S+-1><:#1084,8486><:f180,BArial,0,0,0>The Human R<:f><:f180,BArial,0,0,0>esources<:f><:f180,BArial,0,0,0> department at 
<:f><:f180,BArial,0,0,0>company headquarters is responsible for defining<:f><:f180,BArial,0,0,0> job descriptions,<:f><:f180,BArial,0,0,0> job grades, and<:f><:f180,BArial,0,0,0> policies and procedures for hiring and performance review. F<:f><:f180,BArial,0,0,0>
ield<:f><:f180,BArial,0,0,0> offices hire autonomously, so Human Resources pulls employee information from the field office to keep records up-to-date and to administer benefits. 
<:f>

<+@><:s><:S+-1><:#211,8486><:f180,BArial,0,0,0>There are four types of documents<:f><:f180,BArial,0,0,0> in the Human Resources 
<:f><:f180,BArial,0,0,0>database.

<+@><:s><:S+-1><:#643,8486><+!><:f180,BArial,0,0,0>Employee Statistics<-!> - This is <:f><:f180,BArial,0,0,0>a main document that<:f><:f180,BArial,0,0,0> 
<:f><:f180,BArial,0,0,0>stores<:f><:f180,BArial,0,0,0> basic information about an employee such as<:f><:f180,BArial,0,0,0> name, address, social security number, employee number, current job title,<:f><:f180,BArial,0,0,0> grade, and<:f><:f180,BArial,0,0,0> 
salary.  <:f>

<+@><:s><:S+-1><:#432,8486><+!><:f180,BArial,0,0,0>Performance Review <-!>- This is a <:f><:f180,BArial,0,0,0>response document<:f><:f180,BArial,0,0,0> that contains an<:f><:f180,BArial,0,0,0> employee's annual performance reviews.

<+@><:s><:S+-1><:#432,8486><+!><:f180,BArial,0,0,0>Salary History<-!> - This is a response document that 
<:f><:f180,BArial,0,0,0>contains <:f><:f180,BArial,0,0,0>the date of each employee raise, and the employee's new annual salary.<:f>

<+@><:s><:S+-1><:#432,8486><+!><:f180,BArial,0,0,0>Benefits - <-!>This is a response document that summarizes the employee's current insurance, profit sharing, retirement, and education reimbursement selections.<:f>

<+@><:s><:#480,8486><:f180,BArial,0,0,0>The following table<:f><:f180,BArial,0,0,0> describes the<:f><:f180,BArial,0,0,0> access settings assigned to users in the ACL of this 
<:f><:f180,BArial,0,0,0>database.<:f>

@Dhead@<+@><:s><:S+-1><:t2>

@Dhead@<+@><:s><:S+-1><:#221,8486><:f180,BArial,0,0,0>Roles assigned to this database

<+@><:S+-1><:#960,8486>The database includes a role named Review made up of all members of the ACL with Author access or higher except the group Field AAs. This role was added to the create access list for the Performance Review form so that members of the group Field AAs do not 
compose performance reviews. <:X8,12;Index "Examples" # "using a role"> 

@See also prnt@<+@><:s><:S+-1><:#480,8486>For more information on roles, see "About roles and refining database access" later in the chapter.

@Dhead@<+@><:s><:S+-1><:#245,8486>Example 3: distributed customer support database

<:s><:S+-1><:#720,8486>Seascape Electronics of Portland, Oregon, has a large installed base of customers in the Pacific Rim. Their telephone support department maintains a database called Technical Support that it makes available to its largest customers.

<:s><:S+-1><:#240,8486>There are three types of documents in the Technical Support database.

<:s><:#480,8486><+!>Question<-!> - A main document containing a question from a customer about a Seascape product.

<:s><:#240,8486><+!>Response<-!><+!> - <-!>Seascape's response document to a customer Question document.

<:s><:#480,8486><+!>Announcement -<-!> A main document composed by Seascape employees to alert customers to topics such as newly certified hardware and product upgrades.

<+@><:s><:S+-1><:#240,8486>

<+@><:s><:S+-1><:#480,8486>The following table describes the access levels assigned to users in the ACL of this database:

<+@><:s><:S+-1><:t1>

@Dhead@<:s><:S+-1><:#245,8486>Roles assigned to this database

<+@><:s><:S+-1><:#960,8486>The database includes a role named Announce made up of specific members of the Customer Support team qualified to create Announcements. The Announce role has been added to the create access list for the Announcement forms so that only these members of Custo
mer Support can create announcements. <:X8,13;Index "Examples" # "using a role">

@Ahead@<:s><:#390,8486><:f><:f>Classifying names in the ACL for additional security

<:s><:#720,8486>You can classify names in the ACL for additional security. For example, classifying S. Ireland (Sam Ireland) as a person prevents people in a group S. Ireland (Southern Ireland) from accessing a database using that name. 

@Numbered list@<:s><:#240,8486>Select the database icon and choose File - Database - Access Control.

@Numbered list@<:s><:#240,8486>Select a name in the ACL that you want to classify.

@Numbered list@<:s><:#480,8486>Click the drop-down arrow in the User Type box and select one of the following types:

@Indnt bullet@<:s><:#240,8486>Person

@Indnt bullet@<:s><:#240,8486>Server

@Indnt bullet@<:s><:#240,8486>Group (of persons and servers)

@Indnt bullet@<:s><:#240,8486>Group of Persons

@Indnt bullet@<:s><:#240,8486>Group of Servers

@Numbered list@<:s><:#240,8486>Click OK.

<:s><:#480,8486>An icon identifying a name by its type appears next to a name that uses this feature.

@See also btn@<:s><:#240,8486><:N798421639,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

<:s><:#240,8486>

@Ahead@<:s><:#390,8486>Ways to rename an entry in the ACL

<:s><:#240,8486>You can rename an entry in the ACL by:

@Bullet@<:s><:#240,8486>Typing a new name  

@Bullet@<:s><:#240,8486>Selecting a name from a Name & Address Book 

@See also btn@<:s><:#240,8486><:N798421988,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Bhead title@<:s><:#260,8486><:f200,BArial,0,0,0><+!><:ZDDE_BOOKMARK21>Renaming an entry in the ACL by selecting from a Name & Address Book<:Z~DDE_BOOKMARK2><-!><:f>

@Numbered list@<:s><:#240,8486>Select the database icon and choose File - Database - Access Control. 
<:X8,14;Index "ACL" # "renaming an entry in">

@Numbered list@<:s><:#240,8486>Select the entry you want to rename and click Rename.

@Numbered list@<:s><:#240,8486>Click Choose.

@Numbered list@<:s><:#240,8486>Click the drop-down arrow and select a Name & Address Book.

@Numbered list@<:s><:#240,8486>Select the name of a person, server, or group from the Name & Address Book.

@Numbered list@<:s><:#480,8486>(Optional) Click Open to read the Name & Address Book document for the selected name and then click Close when you are finished.

@Numbered list@<:s><:#480,8486>(Optional) Click "Copy to Local" to copy a selected name to your local address book. 

@Numbered list@<:s><:#240,8486>Click OK twice. 

@See also btn@<:s><:#240,8486><:N798421988,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

<:s><:#240,8486><:f200,BHelv,0,0,0><:ZDDE_BOOKMARK22>

@Bhead title@<:s><:#260,8486><+!><:f200,BHelv,0,0,0>Renaming an entry in the ACL by typing a new name<-!><:f>

@Numbered list@<:s><:#240,8486>Select the database icon and choose File - Database - Access Control. 
<:X8,14;Index "ACL" # "renaming an entry in">

@Numbered list@<:s><:#240,8486>Select the entry you want to rename.

@Numbered list@<:s><:#240,8486>Click Rename.

@Numbered list@<:s><:#240,8486>Type a new name.

@Numbered list@<:s><:#240,8486>Click OK.

@See also btn@<:s><:#240,8486><:N798421988,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

<:s><:#240,8486><:f200,BHelv,0,0,0>

@Bhead title@<:s><:#260,8486>Removing an entry from the ACL

@Numbered list@<:s><:#240,8486>Select the database icon and choose File - Database - Access Control. 

@Numbered list@<:s><:#240,8486>Select the entry you want to remove.

@Numbered list@<:s><:#240,8486>Click Remove. <:X8,15;Index "ACL" # "removing entry from"><:f>

@Numbered list@<:s><:#240,8486>Click OK. 

@See also btn@<:s><:#240,8486><:N798421988,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Bhead title@<:s><:#260,8486><:ZDDE_BOOKMARK1>Listing names in the ACL by access level

@Numbered list@<:s><:#240,8486>Select the database icon and choose File - Database - Access Control. 
<:X8,15;Index "ACL" # "Listing by level"> <:X8,15;Index "Access levels" # "listing names by">

@Numbered list@<:s><:#720,8486>Click the drop-down arrow next to "People, Servers, Groups" and select a specific access level. The ACL displays only names with the selected access level.

@Numbered list@<:s><:#240,8486>Click OK.<:Z~DDE_BOOKMARK1>

@See also btn@<:s><:#240,8486><:N798421988,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>
 

@Ahead@<:s><:#390,8486>About roles and refining database access

<:s><:#480,8486>A designer can give a subset of users or servers in the ACL access to specific database components. The designer can do this by

@Bullet@<:s><:#240,8486>Creating Author fields that limit who can edit specific documents

@Bullet@<:s><:#240,8486>Creating Reader fields that limit who can read specific documents

@Bullet@<:s><:#240,8486>Defining view properties to limit who can see a view

@Bullet@<:s><:#240,8486>Defining form properties to limit who can see documents created with a form

@Bullet@<:s><:#240,8486>Defining form properties to limit who can create documents with a form

@Bullet@<:s><:#240,8486>Defining sections to limit who can edit portions of a document

@See also prnt@<:s><:#480,8486>For more information on restricting access to specific database components, see the Application Developer's Guide.

<:s><:#720,8486>A role is a means of defining this subset of users and/or servers. A database manager first creates a role and a designer then selects the role for inclusion in an access list for a specific database component.  
<:X8,15;Index "Roles" # "defined">

<:s><:#720,8486>Defining a role requires coordination between the database manager and designer. The manager must talk to the designer to determine if a role is necessary and if so which users or servers should be listed in it. 
<:X8,15;Index "Roles" # "defining"><:X8,15;Index "Defining a role" #>

@Note@<:s><:#720,8486>If there are replicas copies of a database it is important to include all replicating server names in the roles to ensure that all information replicates between servers.

@Bhead@<:s><:#260,8486>Advantages to using roles

<:s><:#720,8486>Database designers can create access lists for database components without using roles; individual names or groups already listed in the ACL are acceptable entries. However, roles offer the following advantages:<:X8,16;Index "Roles" # "advantages to using">

@Bullet@<:s><:#1680,8486>It's easier and faster to modify names in a role than individual names. To change an individual name, you must not only update the access list in the form, view, or field that uses it, but also manually update the name in all documents that contain it. 
<:f180,BArial,0,0,255><+!><+">(Is this true just for Reader and Author names fields or for any view or form access lists? 
<-"><-!><:f> Updating the existing documents can take a considerable amount of time as can the replication necessary to propagate the changes.  

@Bullet@<:s><:#960,8486>Roles appear in the Access Control List dialog box and signal that a database contains components with restricted access. If roles are not used, a manager is more likely to overlook assigning access to database components when modifying the ACL.<-!><-">

@See also btn@<:#240,8486>{bmc 1details.bmp}See examples 

@See also btn@<:s><:#240,8486><:N798422853,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Bhead title@<:s><:#260,8486><-!><-"><:ZDDE_BOOKMARK11>Defining a role for a database<:Z~DDE_BOOKMARK1>

<:s><:#480,8486>After you define an ACL for a database, you can follow these steps to define a role. A role is specific to one database. You can create up to 75 roles in a database.

@Numbered list@<:s><:#240,8486><:f,,>Select the database icon and choose File - Database - Access Control<:f><:f,,>.<:f>

@Numbered list@<:s><:#240,8486>Click the Roles icon.

@Numbered list@<:s><:#240,8486>Click Add. 

@Numbered list@<:s><:#480,8486>Type a name for the new role then Click OK. The name of the access role appears surrounded by brackets <[> ].

@Numbered list@<:s><:#240,8486>To assign a name in the ACL to a role, click the Basic icon.

@Numbered list@<:#480,8486>Select a name to include in the role then select the role in the Roles box to display a checkmark. 

@Numbered list@<:#480,8486>To remove a name from a role, select the name then click the role to remove a checkmark.

@Numbered list@<:s><:#240,8486>Click OK.

<:s><:#480,8486>Once you define a role, the database designer can create database access lists that use the role.

@See also prnt@<:s><:#480,8486>For instructions on limiting access to specific database components, see the Application Developer's Guide.

@See also btn@<:#240,8486><:ZDDE_BOOKMARK221>{bmc 1details.bmp}See examples 

@See also btn@<:s><:#240,8486><:N798422853,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Chead title@<:s><:#240,8486><-!><-">Examples: Defining a role for a database 

@Dhead@<:s><:#480,8486>Example 1: Using a role to limit who can create documents with a specific form

<:s><:#1920,8486>A company has developed a Human Resources database that contains information on the company's  human resource policies as well as each employee's performance review. Supervisors in the Human Resources department and their administrative assistants are liste
d with Author access in the database ACL. To prevent administrative assistants from composing Performance reviews, the database manager creates a role called Supervisors that includes only supervisor names. For the Performance review form property "Who can 
create documents with this form," the designer selects only the role Supervisors. 
<-!><-"> <:X8,17;Index "Roles" # "examples of"><:f>

@Dhead@<:s><:#240,8486>Example 2: Using a role in a view's read access list

<:s><:#960,8486>To obtain employee feedback, each quarter a company's Technical Services department mails a Tech Services Review form to all employees. Employees complete the form and mail it to a Service Request Tracking database which displays the responses in the view T
ech Service Performance.  <:X8,17;Index "Roles" # "examples of"> <:X8,17;Index "Examples" # "using a role">

<:s><:#1920,8486>The default access for the Service Request Tracking database is Reader. However, the manager of the Technical Services department wants to allow only himself and the technicians that work for him to have access to  the Tech Service Performance view. The man
ager decides to create a read access list for the Tech Service Performance view that includes only the Technical Services manager and technicians.  After determining that there is no group in the ACL that corresponds to this subset of users, the database ma
nager creates a role that includes this subset and adds the role to the view's read access list.

@See also btn@<:s><:#240,8486><:N798422853,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@See also btn@<:s><:#240,8486>

@Bhead title@<:s><:#260,8486>Displaying the members of a role

@Numbered list@<:s><:#240,8486><:f,,>Select the database icon and choose File - Database - Access Control<:f><:f,,>.<:f>

@Numbered list@<:#480,8486>Select a name in the ACL. If a checkmark appears next to a role in the Roles box, the selected name is assigned to the role.

@Numbered list@<:s><:#240,8486>Repeat step 2 to see the status of additional names.

@Numbered list@<:s><:#240,8486>Click OK.

@See also btn@<:s><:#240,8486><:N798422853,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Bhead title@<:s><:#260,8486>Changing the members of a role

@Numbered list@<:s><:#240,8486><:f,,>Select the database icon and choose File - Database - Access Control<:f><:f,,>.<:f>

@Numbered list@<:#720,8486>Select a name in the ACL. A checkmark next to a role in the Roles box indicates that the selected name is a member of the role. No checkmark indicates that the name is not a member of the role. 

@Numbered list@<:#240,8486>Select a role to add or remove a checkmark for the selected name.

@Numbered list@<:s><:#240,8486>Click OK.

@See also btn@<:s><:#240,8486><:N798422853,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Bhead title@<:s><:#260,8486>Renaming a role

@Numbered list@<:s><:#240,8486><:f,,>Select the database icon and choose File - Database - Access Control<:f><:f,,>. 
<:f>

@Numbered list@<:s><:#240,8486>Click the Roles icon.

@Numbered list@<:s><:#240,8486>Select the role you want to rename.

@Numbered list@<:s><:#240,8486>Click Rename, type the new name, and click OK twice.

<:s><:#480,8486>Any database component access lists to which the role applies automatically reflect the new name.

@See also btn@<:s><:#240,8486><:N798422853,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Bhead title@<:s><:#260,8486>Removing a role

@Numbered list@<:s><:#240,8486><:X8,18;Index "Roles" # "removing">Select the database icon and choose File - Database - Access Control.

@Numbered list@<:s><:#240,8486>Click the Roles icon.

@Numbered list@<:s><:#240,8486>Select the role you want to remove.

@Numbered list@<:s><:#240,8486>Click Remove then click OK.

<:s><:#480,8486>When you remove a role, Notes automatically deletes it from any database component access lists.

@See also btn@<:s><:#240,8486><:N798422853,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Bhead title@<:s><:#260,8486>Enforcing the ACL on local replicas

<:s><:#1200,8486>By default, people have Manager access to local replicas of databases created from servers, regardless of the level of access they have on the server replicas. This allows them to make changes on local replicas that their access levels on server replicas pr
events. Although these changes can't replicate back to servers, you can prevent people from making them at all.

@Numbered list@<:s><:#480,8486><:X8,18;Index "Roles" # "removing">Select the database icon for a server database and choose File - Database - Access Control.

@Numbered list@<:s><:#240,8486>Click the Advanced icon.

@Numbered list@<:s><:#480,8486>Select "Uniform Access Control List across all replicas of database" and click OK.

@See also btn@<:s><:#240,8486><:N798423932,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Ahead@<:s><:#390,8486>About updating the ACL

<:s><:#480,8486>An important responsibility of a database manager is updating the database ACL as needed. You may need to update the ACL for any of the following reasons: 
<:X8,19;Index "ACL" # "maintaining">

@Bullet@<:s><:#480,8486>Users listed in the ACL leave the organization. Remove their names from both individual and group listings in the ACL.

@Bullet@<:s><:#1440,8486>Users need access to the database or servers need access to replicate with the database. If possible, add new names to existing groups in the ACL rather than listing names individually. Consider whether to include new names in any roles associated with the 
database. If the database does not use roles, check whether there are access lists associated with forms, views, fields, or sections and if so consider whether to include new names in these lists.

@Bullet@<:s><:#240,8486>Users listed in the ACL change their names. 

@Bullet@<:s><:#240,8486>Users listed in the ACL need new levels of access.

@See also prnt@<:s><:#480,8486>For information on writing a script to modify the ACL and roles, see "Examining and adjusting access control lists" in Chapter 3 of the Programmer's Guide.

<:s><:#240,8486>e<:ZDDE_BOOKMARK23><:N798424119,KB,65535,1,1
@@Section("See related topics",9, SWISS, 0, 2313, 64, 1, 360, "")

>

@Ahead@<:s><:#390,8486>About using a server agent to update the ACL

<:s><:#1680,8486>A Notes administrator can use an administration agent on a server to change person, group, or server documents in the public Name & Address Book and automatically update database ACLs to reflect the changes. For example, when a person leaves a company, the 
administration agent can delete the person document from the Name & Address Book, delete the name from any groups that include it, and remove the name from the ACLs<:f180,BArial,0,0,255><+!><+"> (and roles?)<-"><-!><:f> of any databases that assign the serv
er as an administration agent server.

<:s><:#480,8486><:ZDDE_BOOKMARK12>To automatically update ACLs in a database, you must assign an administration agent server to it<:Z~DDE_BOOKMARK1>.

@Bhead title@<:s><:#260,8486>Using a server agent to update the ACL

<:s><:#720,8486>To use an administration agent on a server to automatically update names in an ACL, you must assign the database an administration agent server. Ask your Notes administrator which server to specify.

@Numbered list@<:s><:#240,8486>Select the database icon and choose File - Database - Access Control.

@Numbered list@<:s><:#240,8486>Click the Advanced icon.

@Numbered list@<:s><:#240,8486>Below Administration Agent Server, select Server.

@Numbered list@<:s><:#480,8486>Click the drop-down arrow and select the server that runs a server administration agent.

@Numbered list@<:s><:#240,8486>Click OK.

@Ahead@<:s><:#390,8486>Ways to monitor ACL changes

<+@><:s><:S+-1><:#480,8486>If you manage multiple replicas of a database, you can use the following methods to monitor any ACL changes made to them:

@Bullet@<:s><:#240,8486>View the ACL change history  

@Bullet@<:s><:#240,8486>Use ACL Monitor documents 

@Bhead title@<+@><:s><:S+-1><:#259,8486>Viewing the ACL change history

<+@><:s><:S+-1><:#240,8486>To see a chronological list of changes made to the ACL:

@Numbered list@<+@><:s><:S+-1><:#240,8486>Select  the database icon, choose File - Database - Access Control.

@Numbered list@<+@><:s><:S+-1><:#240,8486>Click the Log icon.

@Numbered list@<+@><:s><:S+-1><:#240,8486>Click OK.

<:s><:#240,8486>

@Bhead title@<+@><:s><:S+-1><:#259,8486>Using an ACL Monitor document

<+@><:s><:S+-1><:#720,8486>The Notes administrator can create an ACL Monitor document to monitor ACL changes made to any replica and send you an e-mail notification when changes occur. 

@See also prnt@<+@><:s><:S+-1><:#240,8486>For more information, see the Administrator's Guide.

<:s><:#240,8486>

<:#240,8486>

>

[Embedded]
00081192
