Protecting a cell from an Admin user

[richeb71]

I am pretty sure that this is not possible, but figured I would ask just in case it is. I have been trying to figure out a way to make specific cells in a cube Read only for all users in the Admin Group. I have created a Cell Security Control Cube and assigned "Read" to the specific cell for the Admin group, with no luck. The issue I am having is that there are users in the Admin group that build and run processes and chores that have, on occasion, mistakenly changed the data in these cubes. These users still need to have the ability to build and run processes and chores, but not with total write access to every cube. Is this possible?

Thanks

Rich

[LoadzaGrunt]

Apologies for not actually answering the question - but you could sort yourself out with a development environment so that process-builders aren't zapping your production data ....

[lotsaram]

In addition to it's object security model TM1 also has another layer of security known as locking. If a cube or dimension is locked then no changes can be made to the object regardless of the security access of the user. Element locking is also available which prevents data changes against elements that are locked (as per element security this will apply across all cubes that the dimension in question is part of.) In effect locks prohibit changes by all users (including TI updates.)

It isn't bombproof. A lock can be applied (and released) by any admin user so if an admin user is determined to make a change or needs to do so they still can.

So the answer to your question isn't a straight no, it's more "kinda sorta" in that you could lock a whole cube or you could lock specific elements but you can't lock specific dimension intersections as per cell security.

In addition to thinking about a development environment do your admin users need additional training to prevent such accidental changes?

[richeb71]

Thanks for the quick replies.

Unfortunately, using a DEV environment and migrating to PRD environment is not an option. But, when I started replying to your response I figured out a solution. (Not sure why I did not think of this sooner)

The reason that I was asking how to protect a specific cell was because at some point after the 'Actual' data is loaded for the month, there is a manual split of 2 specific cells into the original cell and another cell. The split is a different percentage each month. On occasion, these cells have been accidentally changed after the split has occurred. I realized that instead of having the user enter the amount into each cell, they can just create a rule defining each cell as the amount.

Thanks again for your assistance.

Rich

[Steve Vincent]

also ensure the cubes have logging turned on and the TIs they are using don't turn it off. Doesn't stop them changing it but at least makes recovering the data nice and easy.