Authorization concepts: Nobody wants them but everybody needs them

An authorization concept is defined as the sum of all authorization rules across the entire business. Or, in other words, an authorization concept determines under which circumstances an employee can view specific information. 

As a rule, authorization concepts are stored in digital applications. If, based on the authorization concept, the employee is authorized to view the information, then they can access the file. The system rejects unauthorized requests.

Authorization concepts aim to manage access rights efficiently. Not every employee has access to every document. And there are good reasons for this as you’ll find out below: 

Reducing the flood of information 

An authorization concept can help you to reduce information overload. Large amounts of data make it difficult for employees to find the right information. When the flood of information continues to grow, the search for the right resources is even slower – especially when employees don’t know how to leverage this information. 

If there is an authorization concept, an HR employee will not see the document. Instead, they get access only to information that they need to do their job. This helps employees to focus on what is relevant. 

Example: If an HR employee sees a document with sales figures, they might interpret the data incorrectly and conclude that the business is doing poorly. This can make employees feel insecure. In fact, the sales figures are an unfinished working document. The annual financial statements have not yet been finalized, and many deals that would turn the result into a positive have not yet been included. 

Protecting data privacy  

Another important point of authorization concepts is that not everyone in the company can – or should – see everything. Pay statements, for example, are considered personal data. These have to be treated confidentially. Business are bound to do so by GDPR laws. In addition to pay statements, this applies to much more data from employees and customers. 

Authorization concepts designate the employees who are allowed to view personal information – namely only those who need it for their work activities. Limiting access also serves to ensure data security. 

Safeguarding confidentiality agreements 

Security requirements for data increase even further when third-party data are involved. When dealing with outside organizations, your business will often receive information that is confidential. Confidentiality agreements require that the business takes special care to protect this content. Authorization concepts map out these agreements internally. 

Protecting trade secrets 

Resources that have the greatest influence on a company’s business success also require high levels of protection. Authorization concepts protect business secrets from the eyes of employees and primarily competitors. This means that only a select group of people can access sensitive information. 

Authorization concepts are either person-related, role-related, or document/information-related. 

Person-related 

Person-related authorization concepts determine which employee is permitted to have access to which information. Because authorizations are created individually for each employee, this process is complex to manage. You always have to update the authorization concept when something changes in the company on the employee side – particularly, whenever an employee leaves the company, joins the company, changes their position, or takes on new tasks in the organization. 

For this reason, the authorization concept based on persons is recommended only for small companies with few employees. The administrative effort in such cases remains manageable. 

Role-related 

Role-related authorization concepts are less complex. Instead of creating an authorization concept for each employee, every role has its own authorization concept. It defines the access authorizations that match the position and the relevant areas of responsibility. Once role concepts have been created, they are transferred automatically to new employees who join the company or change their internal role or department. 

Document or information-related 

As an alternative, you can create authorization concepts based on documents or information, i.e. independently of people. There are several options for this scenario: 

You benefit when you implement authorization concepts in digital tools. You can make changes to the concepts directly in the software. Document-specific authorizations are retained, for example, even when the document moves from the filing system to the archive. 

As an enterprise content management system (ECM system), Doxis is highly customizable and configurable. This also makes it possible to create very complex authorization concepts. If you integrate third-party systems in the ECM system via interfaces or vice versa, the authorizations also carry over. This means that your authorization concept applies automatically to the entire connected system landscape. 

Authorization concepts between Doxis and SAP SuccessFactors 

Doxis also features an interface to SAP SuccessFactors. Through system integration, SAP accepts all authorization concepts from Doxis. In other words, Doxis transfers all authorization concepts so that they automatically take effect in SAP SuccessFactors. If the authorization concept in Doxis indicates that an employee is not allowed to view pay statements, the employee will also not be able to access them in SAP SuccessFactors. 

Whether artificial intelligence (AI) also follows authorization concepts depends on two questions: 

In Doxis, the AI program Doxi complies with the stored authorization concepts and rules. When a request is made (prompt), Doxi first accesses the Doxis data pool. Only then does it forward the prompt to a language model. 

For example, if an employee asks for sensitive data that does not match their access rights, they will not get this information from Doxi. Doxi only responds with information that an employee is authorized to access. The basis for Doxi’s response is the stored authorization concepts. This means that there are no risks associated with using AI.