Pega Access of Role to Object

Access of Role to Object, usually called ARO, is the rule that says what a role may do with the records of a class. If an operator cannot open, change or delete a case, the ARO for their role is the first place to look.

What an ARO contains

• The role it belongs to, for example Bank:Clerk.
• The class it applies to, for example Bank-Work-Loan.
• The rights granted on instances of that class, such as Open, Update, Delete and Run report.
• Optional conditions, so a right can apply only when an Access When rule is true.
• Optional privileges that give finer actions, such as approving or rejecting.

Older forms of the rule use numeric access levels from 0 (no access) upwards. Newer versions let you choose the right and the condition directly. Check the form on your own version.

How it fits together

1. An operator has an Access Group.
2. The Access Group lists one or more Access Roles.
3. Each role has ARO rules for the classes it needs.
4. When the operator acts on a record, Pega finds the ARO for the class, or the nearest parent class, and checks the right.
5. Any Access Deny that applies is checked as well, and it wins.

A worked example

For a bank's loan application, the team defines three roles:

Role	Open	Update	Delete	Run report
Clerk	Yes	Yes	No	No
Manager	Yes	Yes	No	Yes
Auditor	Yes	No	No	Yes

Each cell is one setting on the ARO of the role for the loan class. Nobody gets Delete, because deleting a loan is done by archiving, not by users.

Tips

• Because ARO uses inheritance, a rule on a parent class covers its children. Check the class tree before writing many similar ARO rules.
• Keep roles small and specific. Combine them in access groups instead of building one giant role.
• Follow least privilege: start with nothing and add only what the job needs.
• Test each role with a real operator, not only as an administrator.

Interview tip

Explain ARO as "the rule that ties a role to a class and lists the rights". Then describe the chain from operator to access group to role to ARO. Related: What is Pega RBAC? and the Security label.