vania-janet/multiturn-rag-retrieval-data huggingface dataset:
See [Accounts, identity management, and access control](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-setup) for more details.<br> * For accounts and resources managed outside of IBM Cloud (such as source code control systems, databases, federated identity providers, user directories, and so on), use solutions for account, identity, and access management that are appropriate for those resources.<br> * For all workload operators, develop and use tools and processes of your choosing that allow operators to request access to be granted, to have access revoked, and so on.<br> * For workload consumers accessing your workloads (both web apps and APIs), use App ID (either federated or not) or bring your own solution.<br><br><br> <br><br> * For operators of the IaaS / Data Center, use your own solutions for account, identity, and access management.<br> * Develop and use tools and processes of your choosing for operators to request access, to be granted access, to have access revoked, and so on.<br><br><br> 
 [Use and maintain nonproduction environments for development and testing](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-non-production-environments) <br><br> * Create a separate IBM Cloud account with a duplicate deployment of the Satellite reference architecture and use it for testing all changes before you promote to your production Satellite location.<br> * Do not put anything into production that has not been tested in an equivalent nonproduction environment.<br> * Treat all nonproduction environments as if they were for production environments by following all of the best practices and Framework controls for each environment you create.<br><br><br> <br><br> * Provide a separate set of hosts that are dedicated to your dev or test Satellite location that are isolated from your production Satellite location.<br><br><br>
* Administrator role on the Billing account management service in the account that is to be imported
* Administrator or Editor role on the Enterprise account management service for the account group or enterprise account
* Administrator role on the Billing account management service for the enterprise account







 Moving an account 

For a user to [move an account within an enterprise](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-enterprise-organizemove-accounts), you must assign the following access policies:



* Administrator role for the Billing account management service in the enterprise account



Then, one of the following two options:



* Administrator or Editor role for the Enterprise account management service for the entire enterprise
* Administrator or Editor role on the current and target account group



For details about the actions users can take for each role, see [Actions and roles for account management services](https://cloud.ibm.com/docs/account?topic=account-account-servicesenterprise-account-management).





 Managing security and compliance 

For a user to manage security and compliance through IBM Cloud® Security and Compliance Center, you must assign the following access policies:



* Administrator or Editor role for Security and Compliance Center
* Custom role for the Enterprise



To create the cutom role with the appropriate permissions, see [Assigning access](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-assign-roles)







 Assigning access in the console 

To assign an access policy to an existing user in the enterprise account, complete the following steps:

You can set the target of the policy to be for the entire enterprise, a specific account group, which can include access to all accounts within it, or even a specific account in an account group.



1. In the IBM Cloud console, click Manage > Access (IAM), and select Users.
2. From the row for the user that you want to assign access, click the Actions icon !
Feature Stand-alone account management Enterprise account management 

 Multitiered hierarchy of accounts NO ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) 
 Billing and payments managed from 1 account ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) 
 Isolation of users and access management per account ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) 
 Isolation of resources and services per account !
Next, you can manage the configuration template by viewing or deleting it in the Instance configurations list.





 Results if you placed an order 



1. The deployment of the regulated workload instance starts automatically and you receive confirmation that the order is being processed. You can check the deployment status, including any issues that might require your attention, by viewing the Deployment history tab of the instance details.
2. When the instance is successfully deployed, the ordered components are installed on your VMware virtual platform. The deployment of the services starts after your order is completed. When the instance is ready to use, its status changes to Available, and you receive a notification by email.



You must manage the IBM Cloud for VMware Solutions components that are created in your IBM Cloud account only from the VMware Solutions console, not the IBM Cloud infrastructure customer portal, or any other means outside of the console. If you change these components outside of the VMware Solutions console, the changes are not synchronized with the console.

CAUTION Managing any IBM Cloud for VMware Solutions components (which were installed into your IBM Cloud account when you ordered the instance) from outside the VMware Solutions console can make your environment unstable. The following activities are considered management activities:



* Adding, modifying, returning, or removing components
* Expanding or contracting instance capacity through adding or removing ESXi servers
* Powering off components
* Restarting services







 Related links 



* [Signing up for an IBM Cloud account](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-signing_required_accountssigning_required_accounts-cloud)
* [Planning for VMware Regulated Workloads](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-planning)
* [Viewing and deleting VMware Regulated Workloads](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-view-delete-instance)
To find out more about programmatically managing your keys, check out the Hyper Protect Crypto Services [key management service API reference doc](https://cloud.ibm.com/apidocs/hs-crypto).
* To learn more about performing cryptographic operations with the cloud HSM, see [Introducing cloud HSM](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-cloud-hsm).
* Use Hyper Protect Crypto Services as the root key provider for other IBM Cloud services. For more information about integrating Hyper Protect Crypto Services, check out [Integrating services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-services).
* For information on how to rotate the master key, see [Rotating master keys by using key part files](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-master-key-cli-key-part).
After you consult with a sales representative to sign up for IBM Cloud Enterprise Savings Plan, the sales team will email you a copy of your quote and information about IBM Cloud's Terms and Conditions.





 How do I add a new commitment? 

Contact your [IBM Cloud Sales](https://www.ibm.com/cloud?contactmodule) representative to add a new commitment to your account.





 Why am I getting invoiced for a commitment I didn’t use? 

Since you committed to a certain amount for a certain period of time and you didn't reach it, IBM Cloud® have the rights to charge you with the remaining amount.





 Can I convert my US-based USD Pay-As-You-Go to a Subscription account? If so, what kind of impact does the commitment model have? 

Yes, you can convert your account from US-based USD Pay-As-You-Go to an Enterprise Savings Plan, but it will be only effective after the term end of your former plan.
For more information, see [Tagging IBM Cloud resources and managing access with tags](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-tagging-resources).<br><br><br> <br><br> * Tag all resources in your IaaS / data center environment based on security attributes that you define. Use tools of your choosing.<br><br><br> 
 [Monitor for security and compliance against a baseline configuration](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-security-compliance-monitoring) <br><br> * Deploy and use tools for monitoring and reporting of security and compliance. Maintain a baseline configuration for your service that consists of automated mechanisms to facilitate information system baseline management. See [Compliance monitoring](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-compliance) for more details.<br><br><br> <br><br> * Deploy and use tools for monitoring and reporting of security and compliance within your IaaS / data center environment. Maintain a baseline configuration for your service that consists of automated mechanisms to facilitate information system baseline management.<br><br><br> 







 Next steps 



* [Set up environment for deployment and configuration](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-deployment-setup-environmentshared-deployment-setup-environment)
Getting started with Managed File Transfer 



 What is IBM MQ Managed File Transfer (MFT)? 

IBM® MQ Managed File Transfer (MFT) transfers file between systems in a reliable, managed and secured way. File transfer activities are logged and this can be used for activity logging. You can configure Managed File Transfer agents and enable queue managers to perform transfers. Managed File Transfer (MFT) provides two topologies :



1. Single queue manager topology : uses a single queue manager as the agent queue manager, command queue manager and coordination queue manager. These terms are described in the next section.
2. Multiple queue manager topology : uses multiple queue managers that act as the agent queue manager, command queue manager and coordination queue manager. More specificially, this topology requires at least 3 queue managers, with one acting as the coordination queue manager, one as the Source Agent queue manager (for creating a Managed File transfer agent) and a command queue manager, and the third queue manager acting as the Destination Agent Queue Manager (for creating an another File transfer agent) and a command queue manager.

Note : In the multiple queue manager topology, you can have the required queue managers all on cloud, all on prem, or a mix of both.



MFT is an integrated component of IBM MQ Advanced. For the latest and complete details of this product, please refer to [Managed File Transfer](https://www.ibm.com/support/knowledgecenter/en/SSFKSJ_9.0.0/com.ibm.wmqfte.doc/wmqfte_intro.htm) in IBM Knowledge Center.





 Components of IBM MFT 

There are three main components of IBM MQ Managed File Transfer. These three components are described below: 1. Coordination Queue Manager : responsible for the collection of agent status, transfer status and transfer activity information. 2. Command Queue Manager : the interface queue manager which bridges the MFT commands and the MQ infrastructure. For example, we submit a MFT file transfer command to a command queue manager which instruct the agent to start or cancel a transfer. 3.
Manager As a manager, you have permissions beyond the writer role to complete privileged actions as defined by the service. In addition, you can create and edit service-specific resources. 
 Reader As a reader, you can perform read-only actions within a service such as viewing service-specific resources. 
 Writer As a writer, you have permissions beyond the reader role, including creating and editing service-specific resources. 







 App Configuration 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use apprapp for the service name.

Platform roles

Service roles

Actions



Table 10. Platform roles - App Configuration
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 Activity Tracker 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use atracker for the service name.

Platform roles

Service roles

Actions



Table 11. Platform roles - Activity Tracker
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies.
The process for restoring an ordering node is largely similar to the process for restoring a peer. However, there are a few additional things to keep in mind.



1. You must stop all the ordering nodes in the cluster by scaling down each deployment to zero before restoring any of the ordering nodes. Note after the nodes have been scaled down, it is not possible to transact. Client applications must resubmit their transaction requests after the ordering service is restored.
2. If you restore all ordering nodes, you must scale all the deployments up to 1 to restart them and give them five minutes to determine leadership before accepting any traffic. It is a best practice to also stop all peers on the network during this process.
3. You must then restore all peers that are connected to that ordering service to a backup taken earlier than the ordering service backup you are restoring to, or provision new peers.



In our example, the flow you would take is:



1. Scale down all five ordering nodes and peer deployments to zero to stop all traffic on the network.
2. Restore the peer nodes to the 3:00 a.m. CouchDB snapshot and the 3:05 a.m. peer pod snapshot.
3. Restore each ordering node to its 5:00 a.m. snapshot taken the same day as the peer snapshots you restored.
4. Scale all five ordering service deployments up to 1 and wait for five minutes after they have started to sync up.
5. Scale all peer deployments up to 1.
The Admin adds users to API Connect and configures services such as the gateways that control customer access to your APIs.

One of the Admin's main jobs is to set up provider organizations and add users. A provider organization is a group of people who use the API Manager component of API Connect. Members of the provider organization create and manage APIs, products, and related assets. API Connect Admins create the provider organizations, add members, and define the roles that control user access.
* API Developer

An API developer creates new APIs and updates existing APIs as needed. The API developer can configure policies that define security restrictions, logging rules, and quotas that control access to your company’s resources.
* API Administrator

After an API developer creates a set of APIs, the API administrator manages the distribution. The API administrator defines plans that determine access to the APIs, bundles a set of related APIs and plans into products, and publishes them to the developer portal where customers can find them. The API administrator also manages the catalogs and spaces where API developers create and test APIs.
* Product Manager

A product manager controls access to the Developer Portal where consumers can subscribe to APIs, which they use in their applications. For each group of customers, the product manager creates a consumer organization that controls access to the Developer Portal. The product manager uses the Analytics feature to track API usage and performance, which helps determine when APIs should be updated or retired.
* Consumer

Consumers are your customers, and are not members of your provider organization. When your organization publishes products that contain APIs, consumers subscribe to the products so they can use the APIs in their applications. A consumer can subscribe to use APIs and products that are developed by different provider organizations. Each provider organization assigns one or more Product Managers to manage the relationship with its consumers. The Product Manager creates consumer organizations and adds customers to give them access to the developer portal.
[Share MSP with consortium members (out of band)](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-export-msp)

[Import MSP JSON](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-import-msp)

[Update orderer member MSP on channel](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-channel)

[Override NoExpirationChecks on each ordering node](/docs/blockchain?topic=blockchain-cert-mgmtibp-console-identities-expired-certs-orderer-override)





Table 5. How to manage the orderer organization admin certificate

 Certificate Description How generated Default expiration How to view expiration How to renew Update MSP Update node admin Update system channel Share with network Impact if expired What to do if expired 

 Ordering service organization admin certificate The admin certificate that is used to administer the ordering service and submit or approve channel updates. The associated admin identity is enrolled with the organization CA before the node and organization MSP are created. Generated when you create the organization MSP and provide the admin identity enroll ID and secret. In addition to being part of the ordering service configuration, this MSP certificate can also be included in the ordering service channels. 1 year Wallet tab: Click the ordering service admin identity tile to view the expiration date of the certificate and private key. <br> <br>MSP tab: Open the ordering service organization MSP tile and the admin certificate expiration date is listed in left column. [Enroll new identity](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-enroll) No action is required when Node OU is enabled for the MSP.
Note: the default display name for this identity is the name of your MSP and the word "Admin". If you select a different name for your MSP, that will be reflected in the default.
5. Click the Generate button to enroll this identity as the admin of your organization and export the identity to the Wallet, where it will be used when creating the peer and creating channels.
6. Click Export to export the admin certificates to your file system. As we said above, this identity is not stored in your console or managed by IBM. It is only stored in local browser storage. If you change browsers, you will need to import this identity into your Wallet to be able to administer the peer. Click Next.
Exporting your organization admin identity is important because you are responsible for managing and securing these certificates. If you switch browsers, you will need to import this admin identity otherwise you will not be able to operate Org1.
7. On the Review MSP information panel, make sure you have entered the correct information. When you are satisfied, click Create MSP definition.
8. After the MSP has been created, click on the tile representing it. Then download the MSP to your local filesystem. You will need to send this MSP to all of the organizations in the channels you join.





 Task: Create the peer organization MSP 



Table 5. Create the peer organization MSP definition

 Display name MSP ID Enroll ID Secret 

 Create Organization Org1 MSP org1msp 
 Root CA Org1 CA 
 Org Admin Cert org1admin org1adminpw 
 Identity Org1 MSP Admin 



After you have created the MSP, you should be able to see the peer organization admin in your console Wallet.





 Task: Check your Wallet 



Table 6. Check your Wallet

 Field Display name Description 

 Identity Org1 CA Admin Org1 admin identity 
 Identity Org1 MSP Admin Org1 MSP admin identity
* UI
* CLI
* API
* Terraform







 Assigning access to account management services 

As the account owner or the administrator of an account management service, you can grant users access to invite users to the account, track billing and usage, and work with support cases. Users with account management access policies can also manage service IDs, access policies, catalog entries, access groups, resources for the Security and Compliance Center service, and work with Context-based restrictions.



 Assigning access in the console 

To assign access to one or all account management services, complete the following steps:



1. In the IBM Cloud® console, click Manage > Access (IAM), and then select Users.
2. Click the user that you want to assign access, then go to Access > Assign access.
3. For the service, select All Account Management services or select a specific account management service. Then, click Next.
4. Scope the access to All resources or Specific resources. Then, click Next.
5. Select any combination of roles or permissions, and click Review.
6. Click Add to add your policy configuration to your policy summary.
7. Click Assign.



To grant another user full access to the account for the purposes of managing user access and all IAM-enabled account resources, you must assign two policies. To create the first policy, select All Identity and Access enabled services with the Administrator platform role and Manager service role. To create the second policy, select All Account Management services with the Administrator role assigned.

Users with the Administrator role for account management services can change the access of other users and remove users from the account, including other users with the administrator role.





 Actions and roles for account management services 

The following tables outline the actions that users can take when they are assigned a specific role for each account management service. Review the information to ensure that you are assigning the correct level of access to your users.



 All Account Management services 

To quickly give users a wide range of account management access, you can assign a policy on all account management services. When a user is assigned a role on All Account Management services, they can complete all of the actions that are associated with that role for each individual service.