Defining Security

This chapter provides an overview of security and discusses:

How to restrict user access.
Element security.
Payee security.

Understanding Security

Security refers to the ability to restrict users from viewing or updating certain data or payees.

In Global Payroll, there are two levels of security:

Element-level security

Restricts the elements that a user can view or update, based on the User Rules Profile page and the Used By, Owner, and Override Levels fields on the Element Name page.
Payee-level security

Restricts the payees that a user can view, based on the standard department-level security in PeopleSoft Enterprise Human Resources.

Note. Global Payroll can also use the group security feature in PeopleSoft Enterprise Time and Labor.

Element Usage Security

You set up profiles for your users that give them access to applicable country-specific element information. For example, if your organization operates only in France, users do not need element information that is specific to the United Kingdom. Element-usage security limits the number of elements that appear in prompt tables to those that are relevant to the user.

Owner Security

Owner security refers to who owns and maintains an element—PeopleSoft or the customer. Certain elements can be modified only by PeopleSoft, you can modify others.

The Owner field on the Element Name page identifies an element’s owner.

See Also

Defining Element Names

Override Levels

Override levels for an element vary, depending on the element type. Typical override levels include Pay Entity, Pay Group, Pay Calendar, Payee, Positive Input, and Via Elements. You indicate these on the Element Name page by using check boxes. These check boxes indicate whether the element can be updated through overrides or by another element.

The update Via Element security feature controls which elements can be updated by another element. You can update an element by means of another element in four places in the application:

Arrays (through the Map Retrieved Fields to Variable Elements fields on the Field Map and Keys page).
Brackets (through the Return Column fields on the Bracket Search Keys/Return Columns page).
Dates (through the Date Extract fields on the Date Extract page).
Formulas (through the Assign To columns on the Formula Definition page).

The system checks the User Rules Profile and element-usage security to ensure that the only elements that are allowed entry are those that can be updated by another element.

See Also

Defining Element Names

Common Elements Used in This Chapter

Prompt edits	Records or views that you use as an online prompt on a specified field.
Query security records	Records or views that you use in PeopleSoft Query.
Search records and search views	Records and views that you use to access a component.

Restricting User Access

You can restrict whether a user can access elements that are defined for all countries or for a specific country and whether a user can take control of PeopleSoft-delivered and maintained elements.

This section provides an overview of restricting access to country-specific elements and discusses how to define elements for user access.

Understanding How to Restrict Access to Country-Specific Elements

When you create an element, you designate (in the Used By field of the Element Name page) whether it can be used by all countries or by a specific country. An element cannot use an element that is defined at a lower level. For example, an element that’s defined as All Countries cannot use an element that’s defined as Specific Country.

The User Rules Profile page defines the default values that users see in the Used By and Country fields when adding an element.

This table shows how the settings on the User Rules Profile page affect the Used By and Country fields on the Element Name page:

User Rules Profile page	Element Name page
Used By = All Countries	Used By = All Countries is the default. Country field hides
Used By = Specific Country	Used By = Specific Country and can’t be changed. Country field defaults to Country and can't be changed.

User Rules Profile page

Element Name page

Used By = All Countries

Used By = All Countries is the default.

Country field hides

Used By = Specific Country

Used By = Specific Country and can’t be changed.

Country field defaults to Country and can't be changed.

Warning! After you save an element that is defined for All Countries, be careful about changing the Used By field. Problems can result if the element has been used in payroll processing.

Note. The User Rule Profile in Global Payroll is in addition to the User Rules Profile in PeopleSoft Enterprise Human Resources.

Page Used to Restrict User Access

Page Name	Object Name	Navigation	Usage
User Rules Profile	GP_OPR_RULE_PRF	Set Up HRMS, Security, User Maintenance, Global Payroll User Profile, User Rules Profile	Control whether a user has access to elements defined for all countries or a specific country. Also define if users can take control of PeopleSoft Delivered/Maintained elements. Create a user ID in PeopleTools before using this page.

Page Name

Object Name

Navigation

Usage

User Rules Profile

GP_OPR_RULE_PRF

Set Up HRMS, Security, User Maintenance, Global Payroll User Profile, User Rules Profile

Control whether a user has access to elements defined for all countries or a specific country. Also define if users can take control of PeopleSoft Delivered/Maintained elements.

Create a user ID in PeopleTools before using this page.

Defining Elements for User Access

Access the User Rules Profile page.

All search views refer to the information that you enter here to determine which elements to display.

Session Default

Used By

Specify which elements the users with this User ID should have access to. Values are:

All Countries: Elements defined for All Countries.

Specific Country: Elements defined only for the country you select in the Country field.

Note. You associate a rule with a country when you define an element on the Element Name page.

Allow PS Element Change (allow PeopleSoft element change)

Select to enable users to take control of PS Delivered/Maintained elements. Taking control of an element means that a user can edit the element’s definition and change the element owner to PS Delivered-Customer Modified. Once a user takes control of an element, it cannot be changed back to PS Delivered/Maintained.

See Also

Defining Element Names

Enterprise PeopleTools PeopleBook: Security Administration

Element Security

This section discusses the security that governs element selection from within a component.

The following tables indicate element-level security by menus and components. Following is an example of the Search page that is referred to in the tables:

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Elements - All Element Definition Components

Security on the Search Page	Security Governing Element Selection From Within the Component
Add Mode - When you add a new element, the system has no information about the element, so there is no security. Applicable to Non-Add mode. If User Rules Profile = All Countries, then Used By = All Countries Or Used By = Specific Country. If User Rules Profile = Specific Country, then Used By = All Countries Or Used By = Specific Country. Country must match the Country on the User Rules Profile page.	Element-usage security: If Used By = All Countries, then the elements it can use must also be Used By = All Countries. If Used By = Specific Country, then the elements it can use must also be Used By = All Countries Or The elements it can use must be Used By = Specific Country, and the value in the Country field must equal the country that the element is being used by. Update by element security: For the following elements, you can update element security with the Via Element override check box on the Element Name page: - Formula definitions/Assigned To field. - Date definitions/Date Extract fields. - Bracket definitions/Return Column field. - Array definitions/Retrieved fields. Note. If User Rules = Specific Country, you can view all countries, but you cannot change the Used By field on such an element.

Security on the Search Page

Security Governing Element Selection From Within the Component

Add Mode - When you add a new element, the system has no information about the element, so there is no security.

Applicable to Non-Add mode.

If User Rules Profile = All Countries, then Used By = All Countries

Used By = Specific Country.

If User Rules Profile = Specific Country, then Used By = All Countries

Used By = Specific Country. Country must match the Country on the User Rules Profile page.

Element-usage security:

If Used By = All Countries, then the elements it can use must also be Used By = All Countries.

If Used By = Specific Country, then the elements it can use must also be Used By = All Countries

The elements it can use must be Used By = Specific Country, and the value in the Country field must equal the country that the element is being used by.

Update by element security:

For the following elements, you can update element security with the Via Element override check box on the Element Name page:

- Formula definitions/Assigned To field.

- Date definitions/Date Extract fields.

- Bracket definitions/Return Column field.

- Array definitions/Retrieved fields.

Note. If User Rules = Specific Country, you can view all countries, but you cannot change the Used By field on such an element.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Framework, Organizational, Eligibility Groups

Security on the Search Page	Security Governing Element Selection From Within the Component
Security is handled inside the component.	Element usage (which element groups appear on the prompt list): If User Rules Profile = All Countries, then No security. If User Rules Profile = Specific Country, then Used By = All Countries Or Used By = Specific Country. Country on the Element Name page must match the Country on the User Rules Profile page. Note. Elements defined for all countries can be used with elements defined for a specific country. For example, a German variable can be used with a duration element that’s defined for all countries, but it cannot be used with a duration element that’s defined only for France.

Security on the Search Page

Security Governing Element Selection From Within the Component

Security is handled inside the component.

Element usage (which element groups appear on the prompt list):

If User Rules Profile = All Countries, then No security.

If User Rules Profile = Specific Country, then Used By = All Countries

Used By = Specific Country. Country on the Element Name page must match the Country on the User Rules Profile page.

Note. Elements defined for all countries can be used with elements defined for a specific country. For example, a German variable can be used with a duration element that’s defined for all countries, but it cannot be used with a duration element that’s defined only for France.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Framework, Organizational, Pay Entities

Security on the Search Page	Security Governing Element Selection From Within the Component
Add Mode - When you add a new element, the system has no information about the element, so there is no security. Applicable to Non-Add mode. If User Rules Profile = All Countries, then No security. If User Rules Profile = Specific Country, then Pay Entity Country must = User Country.	Supporting Element Overrides - element usage is based on Pay Entity Country: You must enter Pay Entity Country before entering any Supporting Element Overrides. Used By = All Countries Or Used By = Specific Country, and Country on the Element Name page matches Country on the Pay Entity page. Pay Entity Override is selected on the Element Name page.

Security on the Search Page

Security Governing Element Selection From Within the Component

Add Mode - When you add a new element, the system has no information about the element, so there is no security.

Applicable to Non-Add mode.

If User Rules Profile = All Countries, then No security.

If User Rules Profile = Specific Country, then Pay Entity Country must = User Country.

Supporting Element Overrides - element usage is based on Pay Entity Country:

You must enter Pay Entity Country before entering any Supporting Element Overrides.

Used By = All Countries

Used By = Specific Country, and Country on the Element Name page matches Country on the Pay Entity page.

Pay Entity Override is selected on the Element Name page.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Framework, Organizational, Pay Groups

Security on the Search Page	Security Governing Element Selection From Within the Component
Add Mode - When you add a new element, the system has no information about the element, so there is no security. Mode does not equal Add. If User Rules = All Countries, then No security. If User Rules Profile = Specific Country, then Pay Entity Country = User Country.	Rounding/Proration elements - element usage is based on Pay Entity Country: Used By = All Countries Or Used By = Specific Country, and Country matches Pay Entity Country. Supporting Element Overrides - element usage is based on Pay Entity Country: Used By = All Countries Or Used By = Specific Country, and Country matches Pay Entity Country. Pay Group Override is selected on the Element Name page.

Security on the Search Page

Security Governing Element Selection From Within the Component

Add Mode - When you add a new element, the system has no information about the element, so there is no security.

Mode does not equal Add.

If User Rules = All Countries, then No security. If User Rules Profile = Specific Country, then Pay Entity Country = User Country.

Rounding/Proration elements - element usage is based on Pay Entity Country:

Used By = All Countries

Used By = Specific Country, and Country matches Pay Entity Country.

Supporting Element Overrides - element usage is based on Pay Entity Country:

Used By = All Countries

Used By = Specific Country, and Country matches Pay Entity Country.

Pay Group Override is selected on the Element Name page.

Set Up HRMS, Product Related, Global Payroll, Framework, Processing - Run Types

Security on the Search Page	Security Governing Element Selection From Within the Component
Security is handled inside the component.	Element usage (which process list appears on the prompt list): If User Rules Profile = All Countries, then No security. If User Rules Profile = Specific Country, then Used By = All Countries Or Used By = Specific Country, and Country matches User Country.

Security on the Search Page

Security Governing Element Selection From Within the Component

Security is handled inside the component.

Element usage (which process list appears on the prompt list):

If User Rules Profile = All Countries, then No security.

If User Rules Profile = Specific Country, then Used By = All Countries

Used By = Specific Country, and Country matches User Country.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Framework, Calendars, Calendars

Security in the Search Page	Security Governing Element Selection From Within the Component
Applicable to all modes (in relation to the Pay Group field). If User Rules Profile = All Countries, then No security. If User Rules Profile = Specific Country, then Pay Entity Country that is associated with the paygroup must match User Country.	Supporting Element Overrides and Elements to Exclude - element usage is based on Pay Entity Country: Used By = All Countries Or Used By = Specific Country, and Country matches Pay Entity Country. Calendar override check box must be selected.

Security in the Search Page

Security Governing Element Selection From Within the Component

Applicable to all modes (in relation to the Pay Group field).

If User Rules Profile = All Countries, then No security.

If User Rules Profile = Specific Country, then Pay Entity Country that is associated with the paygroup must match User Country.

Supporting Element Overrides and Elements to Exclude - element usage is based on Pay Entity Country:

Used By = All Countries

Used By = Specific Country, and Country matches Pay Entity Country.

Calendar override check box must be selected.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Framework, Calendars, Calendar Group

Security in the Search Page	Security Governing Element Selection From Within the Component
Add Mode - When you add a new element, the system has no information about the element, so there is no security. Applicable to Non-Add mode. If User Rules Profile = All Countries, then No security. If User Rules Profile = Specific Country, then Calendar Run ID Country must match User Country.	Country - Valid countries are based on User Rules Profile Country: If User Rules Profile = All Countries, then No security If User Rules Profile = Specific Country, then Calendar Run ID Country appears as the default in User Country and cannot be changed. Pay Entity/Pay Group/Calendar ID is based on Calendar Run ID Country: You must enter Calendar Run ID Country before entering Pay Entities, Pay Groups, or Calendar Run IDs. Pay Entity Country must match Calendar Run ID Country. Pay Group Country (Country of the Pay Entity that is associated with the Pay Group) must match Calendar Run ID Country. Calendar Country (of the Pay Entity Country that is associated with Pay Group for Calendar) must match Calendar Run ID Country.

Security in the Search Page

Security Governing Element Selection From Within the Component

Add Mode - When you add a new element, the system has no information about the element, so there is no security.

Applicable to Non-Add mode.

If User Rules Profile = All Countries, then

No security.

If User Rules Profile = Specific Country, then

Calendar Run ID Country must match User Country.

Country - Valid countries are based on User Rules Profile Country:

If User Rules Profile = All Countries, then No security

If User Rules Profile = Specific Country, then Calendar Run ID Country appears as the default in User Country and cannot be changed.

Pay Entity/Pay Group/Calendar ID is based on Calendar Run ID Country:

You must enter Calendar Run ID Country before entering Pay Entities, Pay Groups, or Calendar Run IDs.

Pay Entity Country must match Calendar Run ID Country.

Pay Group Country (Country of the Pay Entity that is associated with the Pay Group) must match Calendar Run ID Country.

Calendar Country (of the Pay Entity Country that is associated with Pay Group for Calendar) must match Calendar Run ID Country.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Triggers, Retro Process Definitions

Security on the Search Page	Security Governing Element Selection From Within the Component
For all modes. If User Rules Profile = All Countries, then No security. If User Rules Profile = Specific Country, then Country = User Country.	Security is handled by the search page security.

Security on the Search Page

Security Governing Element Selection From Within the Component

For all modes.

If User Rules Profile = All Countries, then

No security.

If User Rules Profile = Specific Country, then

Country = User Country.

Security is handled by the search page security.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Triggers, Retro Process Overrides

Security on the Search Page	Security Governing Element Selection From Within the Component
For all modes. If User Rules Profile = All Countries, then No security. If User Rules Profile = Specific Country, then Country = User Country.	Element and Forward to Element - element usage is based on Retro Process Definition Country: Used By = All Countries Or Used By = Specific Country, and Country matches Retro Process Definition Country.

Security on the Search Page

Security Governing Element Selection From Within the Component

For all modes.

If User Rules Profile = All Countries, then

No security.

If User Rules Profile = Specific Country, then

Country = User Country.

Element and Forward to Element - element usage is based on Retro Process Definition Country:

Used By = All Countries

Used By = Specific Country, and Country matches Retro Process Definition Country.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Triggers, Retro Event Definitions (retroactive event definitions)

Security on the Search Page	Security Governing Element Selection From Within the Component
Security is handled inside the component	Country Security (which countries appear on prompt list): If User Rules Profile = All Countries, then User is allowed to work on any country in Global Payroll. If User Rules Profile = Specific Country, then The only valid value is the Country that matches User Country. Retro Process Definition (for Event Process Definition) Security (which retro process definitions appear in prompt list): You must select Country before entering a Retro Process Definition. The Country on Retro Process Definition must match the selected Country.

Security on the Search Page

Security Governing Element Selection From Within the Component

Security is handled inside the component

Country Security (which countries appear on prompt list):

If User Rules Profile = All Countries, then

User is allowed to work on any country in Global Payroll.

If User Rules Profile = Specific Country, then

The only valid value is the Country that matches User Country.

Retro Process Definition (for Event Process Definition) Security (which retro process definitions appear in prompt list):

You must select Country before entering a Retro Process Definition.

The Country on Retro Process Definition must match the selected Country.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Triggers, Segmentation Event Definition

Security on the Search Page	Security Governing Element Selection From Within the Component
Security is handled inside the component	Country Security (which countries appear in prompt list): If User Rules Profile = All Countries, then User can work on any country in Global Payroll. If User Rules Profile = Specific Country, then The only valid value is the Country that matches User Country. Element usage is based on Country of Event: Used By = All Countries Or Used By = Specific Country, and Country matches Event Country.

Security on the Search Page

Security Governing Element Selection From Within the Component

Security is handled inside the component

Country Security (which countries appear in prompt list):

If User Rules Profile = All Countries, then

User can work on any country in Global Payroll.

If User Rules Profile = Specific Country, then

The only valid value is the Country that matches User Country.

Element usage is based on Country of Event:

Used By = All Countries

Used By = Specific Country, and Country matches Event Country.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Integration, ChartFields

Security on the Search Page	Security Governing Element Selection From Within the Component
In All Modes. If User Rules Profile = All Countries, then No security. If User Rules Profile = Specific Country, then Pay Entity Country = User Country.	ChartFields - element usage is based on Pay Entity Country: Used By = All Countries Or Used By = Specific Country, and Country matches Pay Entity Country.

Security on the Search Page

Security Governing Element Selection From Within the Component

In All Modes.

If User Rules Profile = All Countries, then

No security.

If User Rules Profile = Specific Country, then

Pay Entity Country = User Country.

ChartFields - element usage is based on Pay Entity Country:

Used By = All Countries

Used By = Specific Country, and Country matches Pay Entity Country.

Set Up HRMS, Product Related, Global Payroll & Absence Mgmt, Elements, Supporting Elements - Element Name and View System Elements by Source

The Element Name page and the System Element by Source page are display-only. Anyone can view these pages.

Payee Security

This section discusses payee security by department and group.

Payee payroll data is sensitive information because it often contains pay-related information. Global Payroll provides payee-level security that restricts the payees that a user can view.

Department Security

Global Payroll delivers the standard Human Resources department-level security. Payee-level security affects all Global Payroll reports as well as every component, search record or view, and prompt record and view that contains the EMPLID field. All components that are entered with an employee ID contain payee-level security.

A department security tree is used to limit the payees that a user can view or report on.

The following tables indicate payee-level security by menus and components.

Global Payroll & Absence Mgmt, Payee Data, Assign Earnings and Deductions

Security on the Search Page	Security Governing Element Selection From Within the Component
Payee-level security applies.	Element usage is based on Country of Payee, which is based on the Pay Entity that is associated with the Pay Group: To determine Payee Country, the system retrieves the payee’s paygroup (where the maximum effective-dated job row is less than or equal to the current date). Then it retrieves the Pay Entity for the Pay Group and looks at the Country. Used By = All Countries Or Used By = Specific Country, and Country matches Payee Country. You can update element security with the Payee Override check box on the Element Name page. Supporting Element Overrides - element usage is based on Element Country: If Element Country = All Countries, then Used By = All Countries. If Element Country = Specific Country, then Used By = Specific Country, and Country matches Element Country.

Security on the Search Page

Security Governing Element Selection From Within the Component

Payee-level security applies.

Element usage is based on Country of Payee, which is based on the Pay Entity that is associated with the Pay Group:

To determine Payee Country, the system retrieves the payee’s paygroup (where the maximum effective-dated job row is less than or equal to the current date). Then it retrieves the Pay Entity for the Pay Group and looks at the Country.

Used By = All Countries

Used By = Specific Country, and Country matches Payee Country.

You can update element security with the Payee Override check box on the Element Name page.

Supporting Element Overrides - element usage is based on Element Country:

If Element Country = All Countries, then

Used By = All Countries.

If Element Country = Specific Country, then

Used By = Specific Country, and Country matches Element Country.

Global Payroll & Absence Mgmt, Payee Data, Create Overrides, Supporting Elements

Security on the Search Page	Security Governing Element Selection From Within the Component
Payee-level security applies.	Element Usage (based on Country of Payee which is based on Pay Entity associated with Pay Group) To determine Payee Country, the system first retrieves the Pay Group for the Payee where the maximum effective-dated job row <= current date. Then the system retrieves the Pay Entity that is associated with this Pay Group and looks at the Country. Used By = All Countries Or Used By = Specific Country, and Country matches Payee Country.

Security on the Search Page

Security Governing Element Selection From Within the Component

Payee-level security applies.

Element Usage (based on Country of Payee which is based on Pay Entity associated with Pay Group)

To determine Payee Country, the system first retrieves the Pay Group for the Payee where the maximum effective-dated job row <= current date. Then the system retrieves the Pay Entity that is associated with this Pay Group and looks at the Country.

Used By = All Countries

Used By = Specific Country, and Country matches Payee Country.

Global Payroll & Absence Mgmt, Absence and Payroll Processing, Prepare Payroll, Manage Positive Input

Security on the Search Page	Security Governing Element Selection From Within the Component
Payee-level security applies.	Element Usage (based on Country of Pay Entity associated with Pay Group) Used By = All Countries Or Used By = Specific Country, and Country matches Pay Entity Country. You can update element security with the Positive Input override check box on the Element Name page. Supporting Element Overrides - element usage is based on Element Country: If Element Country = All Countries, then Used By = All Countries. If Element Country = Specific Country, then Used By = All Countries Or Used By = Specific Country, and Country matches Element Country.

Security on the Search Page

Security Governing Element Selection From Within the Component

Payee-level security applies.

Element Usage (based on Country of Pay Entity associated with Pay Group)

Used By = All Countries

Used By = Specific Country, and Country matches Pay Entity Country.

You can update element security with the Positive Input override check box on the Element Name page.

Supporting Element Overrides - element usage is based on Element Country:

If Element Country = All Countries, then

Used By = All Countries.

If Element Country = Specific Country, then

Used By = All Countries

Used By = Specific Country, and Country matches Element Country.

Group Security

Group security is a Time and Labor security feature that can be used by Global Payroll if the two applications are integrated. Group security enables you to restrict access to employee records and the Global Payroll reports.

See Also

Establishing Static and Dynamic Groups

Enterprise PeopleTools PeopleBook: Security Administration