Security Matrix Template

Matrix 03/25/2021
User Info User Type Group Scenario Groups ProfitCenter Groups

UserName First Last Email Region/L Category A Category B Company Manager Name Manager E-mail Address Date Change Manager
HFM_S_ACTUAL_READ
ocation Changed Comments Approved Date
HFM_R_FUNCTADMIN
HFM_R_CONSOLMGR
HFM_S_ACTUAL_ALL
- Annual review
HFM_S_HIST_READ
HFM_R_MANAGER
HFM_P_ALL_READ
HFM_E_ALL_READ
HFM_S_HIST_ALL
HFM_R_ANALYST
HFM_P_ALL_ALL
HFM_E_ALL_ALL
HFM_R_VIEWER
HFM_R_SUPER
© Ernst & Young 2011. All rights reserved. Confidential Proprietary. Subject to contract. # Sensitivity: Internal Restricted 1 of 33
Matrix 03/25/2021
User Info User Type Group Scenario Groups ProfitCenter Groups

UserName First Last Email Region/L Category A Category B Company Manager Name Manager E-mail Address Date Change Manager
HFM_S_ACTUAL_READ
ocation Changed Comments Approved Date
HFM_R_FUNCTADMIN
HFM_R_CONSOLMGR
HFM_S_ACTUAL_ALL
- Annual review
HFM_S_HIST_READ
HFM_R_MANAGER
HFM_P_ALL_READ
HFM_E_ALL_READ
HFM_S_HIST_ALL
HFM_R_ANALYST
HFM_P_ALL_ALL
HFM_E_ALL_ALL
HFM_R_VIEWER
HFM_R_SUPER
Matrix 03/25/2021
Matrix 03/25/2021
Matrix 03/25/2021
Entity Groups
Matrix 03/25/2021
Entity Groups
Matrix 03/25/2021
Matrix 03/25/2021
HFM Roles 03/25/2021
Role ends with

_All Can read & write
_Read Read only access
Roles Definition
ST
ER
LY
W
A
IE
N
_A
_V
_R
_R
FM
FM
H
H
Advanced User Use the Browser View of the view pane and has access to the
Running Tasks feature X
Application Administrator Perform all administrative tasks in Financial Management. Access

to this role overrides other access settings for the user. A user
who creates an application is automatically assigned this role.
Approve Journals Approve and reject journals
Consolidate Perform Consolidate option
Consolidate All Perform Consolidate All option
Consolidate All with Data Perform Consolidate All With Data option
Create Journals Create, modify, delete, submit, and unsubmit journals
Create Unbalanced Journals Create unbalanced journals
Data Form Write Back from Excel Submit data to Financial Management from a data form opened in
Smart View X
Database Management Copy and clear data, and delete invalid records
Default Perform all default tasks

X
Enable Write Back in Web Grid Enter and save data directly to a Web grid
Extended Analytics Create and execute Extended Analytics queries
Generate Recurring Generate recurring journal templates
Inter-Company Transaction Admin Open and close periods, lock and unlock entities, manage reason
codes, and monitor intercompany transaction process
Inter-Company Transaction Auto Match by Auto-match intercompany transactions by account and process
Account intercompany transactions
Inter-Company Transaction Auto Match by Auto-match intercompany transactions by ID and process
ID intercompany transactions
Inter-Company Transaction Manual Match Manually match intercompany transactions and process
intercompany transactions
Note If a user has the Manual Match with Tolerance role and the
Inter-Company Transaction Manual Match Manually match intercompany transactions with a tolerance check
Manual Match role, the Manual Match role takes precedence.
with Tolerance and process intercompany transactions
Inter-Company Transaction Match Manage intercompany matching templates and process
Template intercompany transactions
Inter-Company Transaction Post/Unpost Post and unpost intercompany transactions and process
intercompany transactions
Inter-Company Transaction Unmatch Unmatch intercompany transactions and process intercompany
transactions
Inter-Company Transaction User Create, edit, delete, load, and extract transactions; run matching
reports by account or ID; run transaction reports; drill through from
modules; and process intercompany transactions
Journals Administrator Perform all tasks involving journals
Load Excel Data Load data from Smart View to Financial Management using the Ad
Hoc module or Excel functions
© Ernst & Young 2011. All rights reserved. Confidential Proprietary. Subject
Sensitivity:
#
to contract.
Internal Restricted 9 of 33
Role ends with

Roles Definition
ST
ER
LY
W
A
IE
N
_A
_V
_R
_R
FM
FM
H
H
Load System Load metadata, rules, and member lists
Lock Data Lock data
Manage Custom Documents Load and extract custom documents to and from the server
Manage Data Entry Forms Manage data forms on the Web
Manage Ownership Enter and edit ownership information
Manage Templates Manage journal templates
Post Journals Post and unpost journals
Read Journals Read journals

X
Receive Email Alerts for IC Transaction Receive E-mail alerts in the Intercompany Transaction module and
in the Intercompany Partner Matching Report module
Receive Email Alerts for Process Receive E-mail alerts in Process Management
Management
Review Supervisor Perform the following functions in process management:
Reviewer 1 View and edit a block of data when that data is at the user's
designated process management level X
The privileges associated with these roles also depend on the
Reviewer 2 See Reviewer 1
user's rights to access entity data.
For example, a user assigned to the Reviewer 1 role can view and
Reviewer 3 change a block1of data when the data is at Review Level 1. After
See Reviewer
Reviewer 1 promotes the block of data to Review Level 2,
Reviewer 1 can view the block of data but can no longer change it.
Reviewer 4 See
NoteReviewer 1 one of these roles can see data in the First Pass
Users with
and Published state and their assigned review level state and
Reviewer 5 higher. They cannot
See Reviewer 1 see data in the Not Started state or in review
level states lower than what they are assigned.
Run Allocation Run allocations
Save System Report on Server Save reports on the server
Submitter Submit a block of data for final approval in the process

management cycle
Task Automation Set up and manage automated tasks
Sensitivity:
#
to contract.
Role ends with

Roles Definition
ST
ER
LY
W
A
IE
N
_A
_V
_R
_R
FM
FM
H
H
Unlock Data Unlock data
Run Equity Pick Up Ability to calculate ownership
Sensitivity:
#
to contract.
BI Roles 03/25/2021
Reporting and Analysis Roles
Role Description
HFM_R_VIEWER
Power Roles
Reporting and Analysis Administrator Conditionally accesses all resources (unless the file is locked by
“no access”), but not all functionality; accesses the Administer and
Impact Manager modules
Applies to Financial Reporting, Oracle's Hyperion® Interactive

Reporting, Oracle's Hyperion® SQR® Production Reporting, and
Reporting and Analysis Global Web Analysis
Universally and implicitly accesses all resources and functionality;
Administrator accesses the Administer and Impact Manager modules
Note: Reporting and Analysis Global Administrators can never be

denied access.
Applies to Financial Reporting, Interactive Reporting, Production
Reporting, and Web Analysis
Content Manager Manages imported repository content and execute tasks, with
implicit access to all resources (unless the file is locked by “no
access”); contains the Data Source Publisher role

Data Source Publisher Imports data source connectivity files
Applies to Interactive Reporting and Web Analysis
Favorites Distributor Pushes content to users’ Favorites folders using the Favorites
Manager

Job Manager Creates and manages public job parameters, output directories,
and output printer locations
Applies to Interactive Reporting and Production Reporting
Schedule Manager Creates and manages events, calendars, time events, public
parameters, and physical resources; creates batches; contains the
Scheduler and Job Manager roles
Applies to Financial Reporting, Interactive Reporting, and

Production Reporting
Interactive Roles
Analyst Accesses interactive content using full analytic and reporting

functionality
X
Applies to Financial Reporting, Interactive Reporting, and Web
Analysis
Content Publisher Imports, saves, and modifies batches, books, reports, and
documents; creates and modifies shortcuts and folders
Sensitivity:
#
to contract.
BI Roles 03/25/2021
Role Description
HFM_R_VIEWER
Content Publisher

Data Editor Pushes Web Analysis data to Essbase
Job Publisher* Imports and modifies documents, jobs, and job output; runs jobs;
contains the Smart Form Publisher role
Personal Page Publisher* Publishes Personal Pages to the repository, where they can be
viewed by other repository users; contains the Personal Page
Editor role
Report Designer Accesses authoring studios to create and distribute documents
Applies to Financial Reporting and Web Analysis
Scheduler Schedules jobs and batches using the Schedule module;

navigates the repository and assigns access control; contains the
Explorer and Job Runner roles
Applies to Financial Reporting, Interactive Reporting, and

Production Reporting
Smart Form Publisher* Loads custom forms for programs (forms prompt job runners to
enter information used to define jobs)
Applies to Production Reporting
Note: You must have the Job Publisher role to leverage Smart
Form Publisher functionality.
View Roles
Dynamic Viewer* Views, reprocesses, and prints Interactive Reporting documents.

X
Explorer Lists repository content in the Explore module and in context using
the Open dialog box; searches, views, and subscribes to content
Note: Access to the repository does not grant access to individual

X
files and folders, which are secured by file properties and
permissions

Interactive Reporting Viewer* Reviews and prints static Interactive Reporting documents
Sensitivity:
#
to contract.
BI Roles 03/25/2021
Role Description
HFM_R_VIEWER
Job Runner* Runs jobs and views public job parameters and physical resources
Personal Page Editor* Creates, modifies, and customizes Personal Pages; copies
content from other users' published Personal Pages
Personal Parameter Editor Defines points of view and personal parameters on database
connections to customize query result sets
Applies to Interactive Reporting, Production Reporting, and Web

Analysis
Viewer Reviews EPM Workspace content; content is static and accessible
only from the Favorites folder
Note: This role provides minimal end-user functionality; use it only X

when no other role assignments are possible.

System Roles
Trusted Application Enables credentialed client-server communication of Interactive

Reporting database connection files (.oce extension) that
encapsulate connectivity, database type, network address, and
database user name information
Sensitivity:
#
to contract.
Scenario
ACTUAL - Actual
BUDGET - Budget
# Sensitivity: Internal Restricted

Security Class
HFM_S_ACTUAL
HFM_S_HIST
HFM_S_BUDGET
HFM_S_HIST

Entity Hierarchy - Legal

IsBase? Seurity Class

Entity Hierarchy - Regional

Seurity Class

Entity Hierarchy -

Seurity Class Profit Center
TOPPC - Profit Center top member

Unique Security Classes Scenario
HFM_P_ALL HFM_S_ACTUAL
HFM_P_DEFAULT HFM_S_BUDGET
HFM_S_HIST

Entity ProfitCenter SecurityGroups
HFM_E_ALL HFM_P_ALL Based on Classes

Scenario Entity
HFM_S_ACTUAL_ALL HFM_E_ALL_ALL
HFM_S_ACTUAL_READ
HFM_S_BUDGET_ALL
HFM_S_BUDGET_READ
HFM_S_HIST_ALL
HFM_S_HIST_READ

ProfitCenter
HFM_P_ALL_ALL
HFM_P_ALL_READ
HFM_P_DEFAULT_ALL
HFM_P_DEFAULT_READ

Security Matrix Template

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Security Matrix Template

Uploaded by

Copyright:

Available Formats

Matrix 03/25/2021

User Info User Type Group Scenario Groups ProfitCenter Groups

User Info User Type Group Scenario Groups ProfitCenter Groups

Role ends with

Application Administrator Perform all administrative tasks in Financial Management. Access

Consolidate Perform Consolidate option

Consolidate All Perform Consolidate All option

Create Journals Create, modify, delete, submit, and unsubmit journals

Create Unbalanced Journals Create unbalanced journals

Default Perform all default tasks

Extended Analytics Create and execute Extended Analytics queries

Generate Recurring Generate recurring journal templates

Role ends with

Lock Data Lock data

Manage Data Entry Forms Manage data forms on the Web

Manage Ownership Enter and edit ownership information

Manage Templates Manage journal templates

Post Journals Post and unpost journals

Read Journals Read journals

Reviewer 7 See Reviewer 1

Reviewer 8 See Reviewer 1

Reviewer 9 See Reviewer 1

Reviewer 10 See Reviewer 1

Run Allocation Run allocations

Save System Report on Server Save reports on the server

Submitter Submit a block of data for final approval in the process

Role ends with

Run Equity Pick Up Ability to calculate ownership

Reporting and Analysis Roles

Applies to Financial Reporting, Oracle's Hyperion® Interactive

Note: Reporting and Analysis Global Administrators can never be

Applies to Financial Reporting, Interactive Reporting, Production

Applies to Interactive Reporting and Web Analysis

Applies to Financial Reporting, Interactive Reporting, Production

Applies to Interactive Reporting and Production Reporting

Applies to Financial Reporting, Interactive Reporting, and

Analyst Accesses interactive content using full analytic and reporting

Reporting and Analysis Roles

Applies to Financial Reporting, Interactive Reporting, Production

Applies to Interactive Reporting and Production Reporting

Applies to Interactive Reporting and Production Reporting

Report Designer Accesses authoring studios to create and distribute documents

Applies to Financial Reporting and Web Analysis

Scheduler Schedules jobs and batches using the Schedule module;

Applies to Financial Reporting, Interactive Reporting, and

Applies to Production Reporting

Dynamic Viewer* Views, reprocesses, and prints Interactive Reporting documents.

Note: Access to the repository does not grant access to individual

Applies to Financial Reporting, Interactive Reporting, Production

Reporting and Analysis Roles

Applies to Interactive Reporting and Production Reporting

Applies to Interactive Reporting and Production Reporting

Applies to Interactive Reporting, Production Reporting, and Web

Note: This role provides minimal end-user functionality; use it only X

Applies to Financial Reporting, Interactive Reporting, Production

Trusted Application Enables credentialed client-server communication of Interactive

# Sensitivity: Internal Restricted

# Sensitivity: Internal Restricted

# Sensitivity: Internal Restricted

# Sensitivity: Internal Restricted

# Sensitivity: Internal Restricted

# Sensitivity: Internal Restricted

# Sensitivity: Internal Restricted

# Sensitivity: Internal Restricted