Hello Team,
We have a Pega application that enables users to log in and raise complaints. Currently, access is provided only to users who belong to the client organization and are assigned appropriate Pega credentials.
We have a new requirement to allow external users who are not part of the client organization to access the application and raise complaints.
Business Requirements
External users should be granted restricted access with the ability to:
- Create and submit complaints.
- View and track the status of their own complaints.
- Upload supporting documents or attachments, if required.
At the same time, these users must not have access to:
- Administrative functions.
- Reports and dashboards.
- Queues, worklists, or workbaskets.
- Complaints or data belonging to other users.
- Any functionality beyond their designated scope.
Key Considerations
The solution should be:
- Secure and compliant with application security standards.
- Scalable to support a growing number of external users.
- Easy to maintain and administer.
- Aligned with Pega best practices for external user access and authorization.
We would appreciate any recommendations, implementation approaches, or real-world experiences regarding:
- Managing authentication and authorization for external users.
- Best practices for designing a restricted-access portal.
- Use of dedicated Access Groups, Roles, or ABAC/RBAC strategies.
- Considerations for self-registration, user provisioning, or SSO integration.
Thank you in advance for your guidance and suggestions.