Permissions Issues

Initial Permissions for new objects

Single object creation:

• If the new object has a "parent" (Item-Collection, Component-Item, Attachment-AttachedTo, Target-IsExternalTargetFor), then:
  • Apply the admin policy of the "parent", if it has one
  • If the "parent" does not have an admin policy, copy its explicit permissions (rightsMetadata)
• Grant explicit "edit" permission to the user creating the object

Batch object creation (e.g., batch ingest, folder ingest)

• Apply the admin policy of the Collection, if it has one, to each object created by the batch process
• If the Collection does not have an admin policy, copy its explicit permissions (rightsMetadata) to each object created by the batch process

Admin Access Level

Proposal: Add "admin" access level to "discover", "read", and "edit"

Purpose: To control aspects of an object other than "content" -- for example, permissions, delete, and relationships(?).