TM1User() variable in Rules

[tm1dev]

I am experimenting with TM1User() in a rule in a development environment. I'm implementing Element security using the Department dimension. I'm assigning users to a group called 'D200' where they can see all data for Department D200 including Salary. However, I want to restrict some users assigned to D200 where they cannot see Salary. I do not want to add 'D200 No Salary' group nor use Cell Security. So, I added a 'No Salary' group and assigned some people to it. Here's how I am using it:

['D200', 'Salary'] = N: DB('}ClientGroups', TM1User(), 'No Salary') @= 'No Salary'
, 0
,CONTINUE);

The rule works as expected but I was wondering if there's a downside using TM1User() this way.

Thank you in advance!

[gtonkin]

If you added the security group, why not just let it do what it should?
Sounds like you need two groups.

Have you test Trace Cell to see that they cannot see the underlying values?

[lotsaram]

Yes there is one helluva downside, namely a security refresh would need to be run in order to achieve the desired element security differences between any 2 users who were otherwise in the same groups but who should have differing element security. Or put another way don't do this, it's a really bad idea.

It's a bad idea anyway to use rules in element security as any change in the rule calculated values requires a security refresh to take effect in the security model, and depending on the number of groups the model has and size of secured dimensions this operation could take a while and will cause locking.

If you need to differentiate security between users then the users need different group assignments, simple as that. The one exception that could be argued is using TM1User function in a cell security rule, but cell security is kind of a special case as it is evaluated on the fly and kind of sits outside the regular security model.

[tm1dev]

Thank you for the quick replies!