For team roles that are common across multiple application contexts, it is useful to centralize the administration of rules. Use dynamic roles as participants in rules created for domains that are parent to domains at the application context level. For example, use a dynamic role to write a rule in an organization domain. The rule is inherited by all application context domains within that organization that are descendants of the domain where the rule is defined.

To create rules that apply for all participants in the system, select Pseudo Role: All. For example, use this role to write a rule that denies all users Delete permission for parts in a given domain. To create rules that apply to object owners, select Pseudo Role: Owner. When a participant checks out an object, such as a part or document, that participant becomes the owner of the checked-out object. You can use Pseudo Role: Owner to create a rule granting Full Control (All) permission to owners of a part for a given domain.

To administer the rules of a large set of users, select All except selected participant when creating your rule. For example, if you have a group that has a certain security clearance, you can restrict the access of all users except those within that group.