Inheriting Entry Access Rights (Scope)

In addition to assigning entry access rights directly on a document or folder, you can also allow documents and folders to inherit the entry access rights assigned to a folder. Laserfiche can take advantage of the hierarchical organization of the repository when determining which documents or folders will inherit entry access rights. To create a cohesive and consistent security policy, we recommend using inheritance wherever possible, rather than configuring security independently on individual documents.

Laserfiche controls inheritance with two mechanisms: scope and an inheritance flag.

• Scope: Determines which entries can be affected by the entry access rights assigned to a folder, controlling the flow of access rights "down" through the folder structure. An entry can be assigned multiple scopes per user or group, which allows you to customize exactly how a folder's security marking will affect subfolders and documents.
• Inheritance flag: Determines if an entry can inherit the entry access rights assigned to parent folders. The inheritance flag can block inheritance from the parent folder regardless of scope and control the flow of access rights from "above" in the folder structure. The inheritance flag is represented by the Inherit rights from parent and include with specified rights check box in the Entry Access dialog box.This option can be either be selected or cleared. When selected, the inheritance flag allows an entry to inherit entry access rights from the parent folder. When cleared, the flag blocks inheritance from the parent folder regardless of scope.

Note: In most cases, this option should remain enabled; clearing it makes it considerably more complicated to implement and maintain a security policy.

Note: Since they do not have a hierarchical structure, field, template, and volume access rights do not inherit rights.

The following table lists the nine possible scopes and shows if the assigned entry access control rights will be applied to a particular entry when that scope is used.

Scope	Applies rights to selected entry	Applies rights to subfolders in selected folder	Applies rights to documents in selected folder	Applies rights to all subsequent subfolders	Applies rights to documents in all subsequent subfolders
This folder, subfolders, and documents	x	x	x	x	x
This folder and subfolders	x	x		x
This folder and its immediate children	x	x	x
Subfolders and documents only		x	x	x	x
Subfolders only		x		x
Documents only			x		x
Immediate children only		x	x
Documents that are immediate children only			x
This entry only	x