Search Results oke_k_access_rules_pk

Overview

OKE_K_ACCESS_RULES is a table in the OKE schema (Oracle Project Contracts) that stores access rules for contract roles. It constitutes the configuration backbone of role-based security within the Project Contracts module, defining which secured object attributes a given contract role may access and at what level. Each row associates a project role with a secured object name, an attribute group, and an attribute code, together with an access level indicator. The module uses this configuration data to determine the visibility and editability of contractual data for users assigned to those roles.

From a Data Vault modeling perspective, the mined FK structure suggests a satellite-leaning classification. The table carries descriptive attributes (ACCESS_LEVEL, ATTRIBUTE_GROUP_TYPE, ATTRIBUTE_GROUP_CODE) that qualify relationships anchored by ROLE_ID and SECURED_OBJECT_NAME, which behave more like natural business keys referencing parent entities than like hubs or links in their own right. This classification is a heuristic suggestion derived from the foreign-key topology rather than a documented property of the EBS data model.

Key Information Stored

The most significant columns of the twelve documented in the 12.2.2 physical schema are:

• ACCESS_RULE_ID — The surrogate primary key (OKE_K_ACCESS_RULES_PK, also indexed as OKE_K_ACCESS_RULES_U1). It uniquely identifies each access rule row and is referenced by downstream compiled-rule records.
• ROLE_ID — Foreign key to PA_PROJECT_ROLE_TYPES. Identifies the contract role to which the rule applies.
• SECURED_OBJECT_NAME — Foreign key to OKE_OBJECT_ATTRIBUTES_B. Names the secured object against which the rule is evaluated.
• ATTRIBUTE_GROUP_TYPE and ATTRIBUTE_GROUP_CODE — Describe the attribute grouping that scopes the rule.
• ATTRIBUTE_CODE — Identifies the specific attribute governed by the rule.
• ACCESS_LEVEL — Encodes the granted level of access for the combination of role, object, group, and attribute.
• CREATION_DATE, CREATED_BY, LAST_UPDATE_DATE, LAST_UPDATED_BY, LAST_UPDATE_LOGIN — Standard EBS audit columns recording row creation and modification provenance.

The business-key candidate is captured by the unique index OKE_K_ACCESS_RULES_U2 on the composite of ATTRIBUTE_CODE, ROLE_ID, SECURED_OBJECT_NAME, and ATTRIBUTE_GROUP_CODE. This composite ensures that a given role holds at most one rule per secured object-attribute combination, distinguishing the business identity of a rule from its surrogate ACCESS_RULE_ID.

Common Use Cases and Queries

Typical scenarios include auditing which roles can reach sensitive contract attributes, replicating security configuration between environments, and troubleshooting visibility problems in Project Contracts. A representative query resolves roles and objects to their descriptive names:

• Join OKE_K_ACCESS_RULES to PA_PROJECT_ROLE_TYPES on ROLE_ID to report access rules by role name.
• Join to OKE_OBJECT_ATTRIBUTES_B on SECURED_OBJECT_NAME and ATTRIBUTE_CODE to obtain attribute descriptions for reporting.
• Filter by ACCESS_LEVEL to enumerate roles with elevated privileges for a given secured object.
• Compare OKE_K_ACCESS_RULES against OKE_COMPILED_ACCESS_RULES on ACCESS_RULE_ID to detect rules that have not yet been compiled or have drifted from configuration.

Because the table is configuration-oriented, queries are usually run in read-only fashion for audit and migration analysis rather than as part of transactional processing.

Related Objects

The following objects are most significant in relation to OKE_K_ACCESS_RULES:

• PA_PROJECT_ROLE_TYPES — Referenced via ROLE_ID; supplies the contract role definition.
• OKE_OBJECT_ATTRIBUTES_B — Referenced via SECURED_OBJECT_NAME and ATTRIBUTE_CODE; supplies the secured object attribute definition.
• OKE_COMPILED_ACCESS_RULES — References OKE_K_ACCESS_RULES.ACCESS_RULE_ID; holds the compiled, runtime-ready form of the access rules.

Together these three tables form the core of the Project Contracts access-rule subsystem: configuration persists in OKE_K_ACCESS_RULES, source role and attribute definitions come from PA_PROJECT_ROLE_TYPES and OKE_OBJECT_ATTRIBUTES_B, and compiled runtime rules are materialized in OKE_COMPILED_ACCESS_RULES.