Skip to main content

​
Overview

Nextedy RISKSHEET respects Polarion’s native permission model while providing additional configuration options for fine-grained access control. Permissions affect:
  • Cell editing — Which fields users can modify
  • ⚙️ Configuration access — Who can edit RISKSHEET configuration
  • 📄 Document operations — Create, edit, and delete risk documents
  • Linked item editing — Modify upstream and downstream work items

​
Permission Layers

RISKSHEET applies permissions in the following hierarchy: diagram

​
Configure Document-Level Permissions

​
Step 1: Set Document Permissions in Polarion

Navigate to Administration > Permissions and configure access for RISKSHEET documents:
  1. Select the Documents permission category
  2. Choose the project or global scope
  3. Assign read/write permissions to user roles
Example permission matrix:
RoleView DocumentsEdit DocumentsDelete Documents
Project Admin✓✓✓
Safety Engineer✓✓✗
Auditor✓✗✗

​
Step 2: Enable RISKSHEET-Specific Optimizations

For large documents where permissions are defined at the document level (not item level), improve loading performance: In Administration > Configuration Properties, add: 
nextedy.risksheet.moduleOnlyPermissions=true
This bypasses item-level permission checks and relies solely on document permissions.
Setting moduleOnlyPermissions=true can significantly reduce loading times for RISKSHEET documents with hundreds of work items when your permission schema does not require item-level access control.

​
Configure Field-Level Permissions

​
Enable Field-Based Access Control

By default, RISKSHEET does not check field-level permissions for performance reasons. To enable granular field access control: 
nextedy.risksheet.checkInstanceFieldPermissions=true
Enabling field-level permission checks increases load time. Only use this setting if your Polarion configuration requires different users to have access to different fields within the same work item.

​
Disable Work Item Prototype Permissions

If you use custom field permissions and need to bypass prototype-level permission checks: 
nextedy.risksheet.checkPrototypePermissions=false
This is useful when you define permissions directly on work item instances rather than relying on type-level (prototype) permissions.

​
Configure Configuration Access

​
Restrict Configuration Editing to Admins

By default, any user with document edit permissions can access Menu > Configuration > Edit Risksheet Configuration. To restrict configuration editing to project administrators only: 
nextedy.risksheet.disable_admin_check=true
Despite the property name disable_admin_check, setting this to true actually enables the admin-only restriction. This property name is a legacy artifact and may be renamed in future versions.
Access control flow: diagram

​
Configure Upstream Column Editing

By default, upstream sub-columns (fields from linked items) are read-only in RISKSHEET. To allow users to edit upstream item properties directly: 
nextedy.risksheet.upstreamSubColumnsReadonly=false
See Enable Editing of Upstream Columns for detailed configuration.

​
Configure Branched Document Permissions

​
Enable Referenced Item Editing

When working with branched documents, referenced items are read-only by default. To allow editing: 
nextedy.risksheet.branchingSupport=true
nextedy.risksheet.editableReferencedWorkItems=true
See Work with Branched Documents for setup details.

​
Common Permission Scenarios

​
Scenario 1: Read-Only Auditors

Requirement: Auditors can view RISKSHEET documents but cannot edit any data. Solution:
  1. In Polarion Administration > Permissions, grant auditors View Documents permission
  2. Do NOT grant Edit Documents permission
  3. No RISKSHEET-specific configuration needed

​
Scenario 2: Field-Specific Access

Requirement: Safety engineers can edit all fields except “Approval Status” which only admins can modify. Solution:
  1. In Polarion, configure field-level permissions for “Approval Status” to admin-only
  2. In Configuration Properties, set: 
    nextedy.risksheet.checkInstanceFieldPermissions=true
  3. RISKSHEET will render the “Approval Status” column as read-only for non-admin users

​
Scenario 3: Performance-Optimized Large Documents

Requirement: 500+ work items in a single RISKSHEET document, permissions defined at document level only. Solution: 
nextedy.risksheet.moduleOnlyPermissions=true
This skips per-item permission resolution and improves load time by 60-80%.

​
Verification

​
Test Document Access

  1. Log in as a user with restricted permissions
  2. Navigate to a RISKSHEET document
  3. Verify that:
    • Users without edit rights see a read-only grid
    • Edit icons and context menus are disabled
    • Save button is not visible

​
Test Field-Level Restrictions

  1. Enable field-level permission checking
  2. Configure Polarion to restrict a specific field
  3. Open RISKSHEET and verify the restricted field renders as read-only (grayed out)
  4. Attempt to edit the field — the cell should not become editable

​
Test Configuration Access

  1. Set disable_admin_check=true
  2. Log in as a non-admin user with document edit rights
  3. Open Menu > Configuration > Edit Risksheet Configuration
  4. Verify that the configuration editor displays an “Access Denied” message
You should now see permission controls applied correctly across RISKSHEET documents, with restricted users unable to modify protected data and configuration access limited to administrators.

​
See Also

KB ArticlesSource Code
  • AppConfigParser.ts
  • AppConfig.ts
  • OpenHelpCommand.ts
  • SystemConsts.java
  • PolarionAppConfigManager.java