Platform, Role, and Contextual Security
About 16% of the CIS-HR exam — see all 4 domains.
HRSD layers three kinds of access control; you must distinguish them.
Platform Security (ACLs)
Standard table/field/record ACLs (read/write/create/delete) still apply because HR tables live on the platform. But HRSD intentionally does not rely on Task-level roles alone for HR data.
Role-Based Security (HR roles and groups)
Key HR roles (names prefixed in the HR scope) include, conceptually:
- HR admin — full HRSD configuration.
- HR manager — manages a COE's agents and configuration within that COE.
- HR case worker / agent (case writer/reader) — fulfills cases within assigned COEs.
- HR basic — minimal role assigned broadly so employees can use Employee Center / open their own cases.
Agents gain access to a COE's cases by membership in that COE's assignment groups combined with the appropriate HR role. Roles are typically delivered through groups, not assigned to users one-by-one. Client role assignment rules can automate role grants.
Contextual Security (COE security, field security, case restrictions)
This is the HRSD-specific layer and a heavy exam focus:
- COE-based access: an agent only reads/writes cases for COEs they are assigned to; a Benefits agent cannot open Employee Relations cases.
- HR profile and HR case security restricts who can view a profile or case beyond ordinary ACLs (e.g., manager-of relationship, subject self-access).
- Field-level security in HR hides/secures individual profile fields (e.g., SSN/tax ID encryption).
- Employee Relations case restrictions and the COE security policy add the strictest gating — even HR admins may be excluded from ER records unless explicitly permitted; ER also adds involved-parties, allegations, and evidence with their own access controls.
- VIP / special handling flags add discretion controls on sensitive subjects.
Mental model: Platform ACL says the table is readable → HR role says you're an HR person → COE/criteria/contextual security says you're allowed THIS case. All layers must pass.
Sample questions from this domain
Three of the 48 in this domain, with the reasoning. The full set is in the question bank.
What is the primary purpose of contextual security (ACLs) on HR data?
- A. To control create, read, write, and delete access to HR records and fields based on roles and conditions ✓
- B. To theme the portal
- C. To define SLAs
- D. To run discovery
Why: Contextual security (ACLs) controls CRUD access to records and fields based on roles and conditions, which is central to protecting HR data. It is unrelated to theming, SLAs, or discovery.
Which HR role typically allows a user to work HR cases as an HR agent/case worker?
- A. The catalog_admin role
- B. The discovery_admin role
- C. An HR agent role such as HR case writer [sn_hr_core.case_writer] (or HR agent [sn_hr_core.basic]) ✓
- D. The web_service_admin role
Why: Working HR cases requires an HR agent role: HR case writer [sn_hr_core.case_writer] can write/work all HR cases, and HR agent [sn_hr_core.basic] gives basic HR Agent Workspace access. catalog_admin, discovery_admin, and web_service_admin are unrelated platform roles.
How does HRSD typically restrict HR agents to only the COE(s) they are responsible for?
- A. By disabling ACLs
- B. Through COE-specific groups and contextual security so agents only access their COE's data ✓
- C. By renaming the case table
- D. By giving every agent admin
Why: COE-specific groups combined with contextual security restrict agents to their COE's data. Granting admin, disabling ACLs, or renaming tables would not provide proper restriction.