Manage access control policies

Access control policies are statements that bring attributes together to establish permissible and impermissible actions. Adobe provides a default policy that can be activated immediately or when your organization is ready to start controlling access to specific objects based on labels. The default policy, Default-Label-Based-Access-Control-Policy, leverages labels applied to resources to deny access unless users are in a role with a matching label.

Configure sandboxes for a policy configure-policy

Policies are applied at the sandbox level to control which sandboxes enforce label-based access control. By default, the Auto-include feature is turned on, which means all current and future sandboxes are automatically added to the policy. When Auto-include is turned off, only the sandboxes you manually add will be subject to the policy’s access control rules.

To begin configuring a policy’s sandboxes, navigate to Permissions in Adobe Experience Cloud. Select Policies from the left panel, then select the Default-Label-Based-Access-Control-Policy from the list.

{modal="regular"}

The policy’s details workspace appears. Select the Sandboxes tab to view the list of sandboxes associated with the policy and access the sandbox configuration options.

{modal="regular"}

Manage Auto-include manage-auto-include

To control which sandboxes are included in a policy, you can toggle the Auto-include feature on or off. When you toggle off Auto-include, future sandboxes will not be automatically added to the policy. However, toggling off the feature will not remove any sandboxes that are already included in the policy.

{modal="regular"}

To re-enable Auto-include, use the toggle to turn it back on. The Enable Auto-include dialog appears prompting you to confirm your selection. Select Enable to complete the configuration setting.

{modal="regular"}

Manually manage sandboxes manually-manage-sandboxes

When Auto-includeis turned off, you can manually add or remove specific sandboxes from the policy. This gives you precise control over which sandboxes enforce the policy’s access control rules.

To add sandboxes:

Select Add Sandboxes from the policy’s sandbox workspace.

{modal="regular"}

The Add Sandboxes dialog appears, displaying your library of available sandboxes. Select the sandbox(es) you wish to add to the policy and then select Save.

{modal="regular"}

To remove sandboxes:

Find the sandbox you wish to remove from the list and select the X icon next to its name.

{modal="regular"}

A confirmation dialog will appear. Select Confirm to finish removing the sandbox from the policy.

{modal="regular"}

Activate a policy activate-policy

To activate an existing policy, select the policy from the Policies tab in Permissions. The policy’s activation status is visible under the Status section.

{modal="regular"}

The policy’s details workspace will display. Select Activate.

{modal="regular"}

The Activate Policy dialog appears. Select Confirm to finish activating the policy.

{modal="regular"}

Next steps

With a policy activated, you can proceed to the next step to manage permissions for a role.