AnsweredAssumed Answered

Variables, Schedules, Logins & Connection Objects - Allowing Access

Question asked by laura_albrecht_automic on Nov 4, 2016
Latest reply on Nov 7, 2016 by joel_wiesmann_automic
The current setup I have is allowing multiple applications within the same client.  Each application has their own queue, folder, etc.  

We limit EDIT access in our QA and PROD environments.  They have full access in DEV.  And some users have EXECUTE access in QA and PROD, but that's it.

We are planning to use the TMS (Transport Management Solution) to move objects between QA, DEV and PROD.

I am contemplating a few things and wanted people's opinion.

1 - Users from the old company are used to being able to edit their own schedules in QA and PROD.  They are OK with limiting EDIT access, but would like to have the ability to schedule something without having to do a deployment / asking my team to do it.  I agree, since I don't really want to be doing this for them.  I am contemplating opening up the access so that they can edit their own schedule objects only.  Does anyone see any negatives with doing this?  Obviously there would be some risk, but they would be limited to doing damage to their own application and they would need to accept that risk.  Am I missing a gotcha?  Should I not allow this?

2 - What are your thoughts on allowing access to users (even in DEV) to create logins and connection objects?  I had initially been allowing this, but now am wondering (based on some conversations with others) that I should not allow this.  Does anyone have any experience with good / bad aspects of this?

3 - SQLI variables.  I had initially been allowing people to create these as well, but now after the conference I'm thinking that I should restrict this.  Thoughts?

4 - To limit changes needed on objects as they move from DEV to QA to PROD I was going to require users to setup a variable object with environment specific information.  Optionally store that information in an include, but then users wouldn't have to change anything when moving their objects.  Just the variable values would be different.  This of course begs the question of how do you make additions / changes to the variable values?  Doing this via deployment packages seems risky, but not a big fan of doing this manually although I don't believe the # of changes in these objects would be high.  Thoughts / opinions?

Are there any other objects that people perhaps limit access to that I'm not thinking of?

Thanks in advance.