There are 5 users that have the same access group now 2 new users join in and we want to restrict them from working on loan case that the other 5 users can work so how do that?-for this i have added an access when rule like checking the operator id is equal to the 5 users in the of privilege rule itself,will that suffice?,then again if 2 new users are again joining then how to restrict them form creating loan cases;i am planning to use dependent roles here and give that in these users access groups.
Your current approach (checking OperatorID in an Access When referenced by a Privilege) will work, but it might not be scalable and is difficult to maintain.
For a production application: Avoid hard coding Operator IDs in Access When rules. Create a dedicated Loan Operations Role (or Access Role). Assign that role only to the 5 users who should work on Loan cases. Use either: Separate Access Groups or Dependent Roles (if the only difference is Loan access). And Secure both: Loan Case Creation and Loan Case Processing (assignments, flow actions, sections)
This follows RBAC model and is easier to maintain when more users join later.
@TanyaS58 to support what @BASAVARAJ said, you can check out this - it has the RBAC to stop creation of the case. There are other bits to ignore for your use case, but hopefully it gives you a starting point.
I suggest to drill down further into the requirements ,
why are the users all belong to the same access group but should not access the case? In that case should the access group be split into different groups?
Is it based on a certain attribute of the case? For example, car loans vs mortgages vs personal vs student? In this case loan type can be a skill associated with the case and also the operator profile.
Also, as we drill down into the requirements - it may point you to a better case design - for example, the loan case type might need to be split into different smaller case types(student/personal etc) - this can give you better granular security control
If everybody must stay in the same Access Group, ABAC is an option. Use an operator attribute and an Access Control Policy to allow or deny creation/access to Loan cases. Discover controls visibility, Read controls opening, Update controls create/modify behavior, and Delete controls removal of instances.
A more effective approach would be to leverage roles or access groups, and also evaluate the feasibility of using when conditions.