security overlay - what am I doing wrong

[stingo]

Is there a piece of knowledge I am missing?
am I getting crazy?

I am trying to create a security overlay cube in my PnL cube ('PA on cloud').
I am creating the cube with the appropriate mapping (in a security TI).
Then I apply
SecurityOverlayCreateGlobalDefault ('Profit and Loss', '1:1:0:0:0:0:0:0:0:0:0:0:0:1:0:1:0');
I check the cube and it is there with the appropriate dimensions as a node.
I then lock a node with the following
SecurityOverlayGlobalLockNode(1, 'Profit and Loss', 'Actual|Company3|Mar 2025|Import');
I check the cube and as if it was magic, the overlay cube contains exactly 1 (lock) in the cell I want to lock.
I then proceed to Refresh the securities (never the less it should work without) just because redundancy.
then I go to a random cell containing the node I just locked, I delete the content and it goes to 0. I put a random number and the cell changes.
So essentially I locked nothing.
I even tried SecurityOverlayGlobalLockCell just as a test and I still achieve nothing.

So the question is, what am I actually doing wrong?

[MarenC]

Hi,

I don't believe the Security Overlay affects Admin users, are you an admin user? Have you tested a non admin account?

Maren

[stingo]

I am an admin but I have an account that is data admin too.
I removed the data admin status on the account and assigned it to some random groups and still no cigar.
I can still write and clean with the no more data admin account.

[gtonkin]

And now there are two of us using security overlays...

In my scenario I am using rules to set the OverlayData to 1 to block intersections.

Data admin can write to these intersections but a TI process that runs as a pseudo-data admin cannot and you need to apply CubeLockOverride in cases where this may be needed.

With that said, I would recommend testing on another user that has no built in Admin roles and seeing if they are blocked, as they should be.

[stingo]

I removed the data admin status from the account but it is still an highway, I can write, clean, rewrite etc.

I would like to lock cells to everyone but this is not really working.

[gtonkin]

Try adding a rule with the following:
['OverlayData']=S:'1';

That should block all input across the defined dimensions, assuming no admin user. On PAoC, ensure the test user is not a subscription admin or similar too (CAMID groups).

[stingo]

Try adding a rule with the following:
['OverlayData']=S:'1';

That should block all input across the defined dimensions, assuming no admin user. On PAoC, ensure the test user is not a subscription admin or similar too (CAMID groups).

I tried via rules.
I tried via TI.

The Overlay is 1.

I can write with Admin, I can write with Data Admin, I can write with no admin, I can write with a TI.

EDIT for clarity:
I created a view with one cell that is closed in the Overlay.
I created a TI that does nothing else than put '1000' in the cell I am looking at.
The TI is successful and the cell is now 1000.

[stingo]

just for the records.

I queried IBM and they confirmed that I am not losing my mind, TIs are not impacted by the layer.
essentially it is an useless feature as you can just put the cell on read.

[Wim Gielis]

And that is why only you and George are using the feature….

[stingo]

if you have a better idea, be my guest.

[lotsaram]

What's your actual requirement?

I never in 25 years so far working with TM1 found something that can't be solved with cell security. I see no need for the overlay cubes TBH.