Skip to main content
Documentation
Documentation
Administrator Guide
Last Updated: 2026-05-15
Set Up Security Policies

Set Up Security Policies

Policies are configurations you can apply to security roles that let you control when and where the role applies. Configuring policies is optional.
Traditionally, when a user is assigned a security role for an organization unit, and if an object is at the same level or under that organization unit, the user is granted the permissions in that security role for the object. Nothing else is considered.
By using policies, you can add additional limitations around attributes. This means for a given object, you may not have this role if the policy doesn't match.
Examples:
  • You can only manage Extended Workforce Management (EWM) and Contingent work orders, not worker profile work orders.
  • You can only manage work orders that are
    Active
    , not in pre-onboarded statuses.
  • You can only view and edit candidates created by client users, not vendor users.
You can also use policies to control roles based on the circumstances of the user, such as more about where and how they are accessing the functionality. This is referred to as context. Currently there is only one support context policy for
Is Bulk Updating
.
  1. From the header, select
    More
    Company Settings
    .
  2. From the
    Security
     section, click
    Security
    Settings
    .
  3. On the
    Policies
    tab, click
    Create
    .
  4. As you complete the task, consider the following restriction options:
    Context Restrictions Option
    Description
    Context Restrictions
    Restricts the role around the circumstance of the action you're trying to take.
    Example: You need to restrict the role to only apply when the role attempts to bulk update. Select
    Only applies when Bulk Updating
    .
    Work Order Restrictions
    Restricts the role around attributes of the work order you want to view or update.
    • Module
    • Status
    • Country
    Example: You need to restrict the role to only apply to Worker Profile Management (WPM) work orders. You would select
    Module
     and
    Worker Profile Management
    .
    Candidate Restrictions
    Restrict your role based on attributes of a given candidate.
    • Vendors
    • Created By
    Example: You only want to see candidates created by client and not by vendors. Select
    Applies only to Client created Candidates
    .
  5. Within each restriction option, choose the appropriate tab for the policy setup:
    Option Description
    Interactive
    Shows the circumstances available for easy selection in the user interface. With this option, you can only select one property per restriction on a policy.
    JSON
    Allows you to create complex expressions with multiple properties including AND/OR logic.
    Example: If you want to restrict a role to manage active WPM work orders only, you can use JSON syntax to establish a work order restriction on
    Module
     and
    Status
    .
  6. Save the policy and navigate to the
    Roles
    tab.
  7. Select one or more roles that you want to add the policy to. In the
    Edit Role
     page, select the policy from the
    Policy
     drop-down menu.
Example
This example illustrates how you can set up a policy that restricts resource managers to bulk update Worker Profile Management (WPM) work orders only.
In an example like this, you'll likely need multiple resource manager roles, as there may be some resource managers who need access across modules.
Context Restrictions Values
Field
Value
Bulk Updates
Only applies when Bulk Updating
Work Order Restrictions Value
Field
Value
Module
Worker Profile Management
After creating the policy, add it to applicable
Resource Manager
roles.