The system allows the definition of configurable profiles autonomously by the client and associates users with different responsibilities within a process. That is, a user, in addition to their user profile, will have a specific role within the context of a process (e.g., executor, validator, approver, etc.). In this way, the client has full autonomy for the configuration and management of the life cycle of business rules and operationalization.
Progressively, and to ensure transversality and coherence throughout the system, Quidgest's proposal (to be discussed in the project) is that the definition of system user profiles be anticipated for the model, ensuring that Genio's impact on these profiles covers all processes that share the same information. In addition to increased integrity, this change facilitates the task of managing user profiles.
Interface-level record management is performed based on user profiles, with only authorized users having the ability to deactivate records. All deactivated records are kept in the database and can be reactivated by technical and/or functional administrator profiles. The process of retention and definitive deletion of records is carried out periodically following the validation rules of retention periods. This definitive deletion action is recorded in a log.
Access profiles, combined with the organizational structure, allow the temporary delegation of responsibilities for processes and access to information. This delegation is made by identifying the start and end date of the delegation of responsibility, which user/profile to replace, and the reason for the replacement. The substitute user is associated with the total or partial responsibilities defined in the responsibility matrix. All this information is kept in history to maintain the traceability of the auditability of the process. It is also worth mentioning that the composable (modular) approach allows the same user to have different privileges in each module without the need to change their login. Access to the system is conditioned by an RBBAC/ABAC model where it is possible to configure the segregation of functions in management/operation and use.
Access profiles ensure the segregation of functions and unitary accesses and allow the definition of a responsibility matrix that ensures, among other examples, that the user who registers the information is different from the user responsible for confirmation. Access levels also guarantee the identification of users or profiles with the ability to export, print, or even massively introduce data into the system (i.e., upload).
The definition of user profiles, including privileges and limitations, can be adapted by requirements identified in the project.
All rules associated with the definition of user profiles are built declaratively and transversally to all access channels (namely direct registration, webservice, API, or import). For example, if the user who confirms an operation cannot be the same as the one who entered the information, this rule corresponds to a write condition (in the Genio model) that checks if the "confirmation" field (which can be a simple check box or a date) becomes filled and compares the person responsible for the insertion with the current user, only allowing recording by a different user (or with a higher level). This definition is declared in the Genio model in less than five minutes, does not require any code input, and has a transversal effect on the entire system for the information or operation in question.
To ensure transversal security and data privacy, it is possible to define a maximum session inactivity duration according to the client's internal rules, and it is possible to change the values according to the identified need. Another key security element is the authentication mechanism, namely the ability to define MFA (Multi-Factor Authentication) which can be requested in processes that require elevated privileges, or in scenarios where non-conventional accesses are attempted by third-party applications. Additionally, it is possible to define local passwords, adjust their minimum complexity, maximum usage time, among other security rules.
The system allows authentication to a single, integrated solution in the client's authentication systems (for example, integrated through Microsoft Active Directory, LDAP, or using external authentication operators using OpenID Connect technology).