We have Entity1 and Entity2, where Entity2 records are segregated using a Type attribute (e.g., BU1, BU2, etc.). Entity1 and Entity2 are connected through a relationship that is managed via the Relationship Facet on the Entity2 profile.
As per our requirements, BU1 and BU2 users should only be able to create and update Entity2 records belonging to their respective business units, including the associated relationships. In other words, BU1 users should not be able to create/update BU2 records or their relationships, and vice versa.
We have implemented Metadata Security, which successfully restricts profile-level updates. BU1 users can create/update only BU1 records, while BU2 users can create/update only BU2 records. When users attempt to update profile attributes on unauthorized records, Reltio correctly returns an Insufficient Privileges error.
However, users can still create or update relationships on records for which they have read-only access. For example, a BU1 user can modify relationships on a BU2 record through the Relationship Facet, even though they cannot update the profile attributes.
Has anyone implemented a similar requirement? Is there a supported way to make the Relationship Facet read-only, hide it, or otherwise restrict relationship create/update operations based on an entity attribute (e.g., Type) and the user's role?
Note: Reference attributes instead of relationships is not a viable alternative in our case.
------------------------------
Abhijit Auddy
Cognizant
------------------------------