All distributions must be signed with a certified signature in order to get the rights associated with them. The rights are constructed independent from the application, but associated with its controlling class as properties during download of a distribution. Besides giving rights, the registration process will also load the class in a controlled and secure way. Access may be granted only for a limited time. Moreover, the user can temporarily disable certain operations she is in principle allowed to perform, to prevent her from accidently executing these operations.
Rights are either persistent or non-persistent.
Overview of the Access Control Service The Access Control policy imposed on Business Applications and Modules are different. Business Applications and Modules can both act as subject or objects once they are registered. A subject gives its rights to the object, when the object shall perform operations on protected actions and data. In order to prevent misuse of the subjects rights in the object, the subject can limit the rights given to the object. Given the identity of the application and the user, an initial set of roles is selected.