Aurena Custom Object contexts/scopes are used to hide different fields on the same page for different groups of users (for example, different hidden fields in Scope A vs Scope B on Customer Order) — is there a way to actually prevent a user assigned to one scope from accessing another scope's version of the page, including the global/unscoped context?

All FAQ questions / Security and access

Answer

No — context/scope mapping is purely a client-side personalization mechanism for giving users a tailored view, not a security boundary. A user assigned to Scope A only sees Scope A's changes by default, but if they know to append the scope parameter to the page's URL (for example, appending a scope query parameter naming Scope B), they can view another context's configuration directly, bypassing whatever fields that context hides. Page configurations and contexts should never be relied on to actually restrict access to data or fields — genuine access control has to be enforced through permission sets and other real security mechanisms, since context/scope switching via the URL is trivially possible for any user who knows about it.

Documentation-based answer. Confirm the product and release before applying it. This answer has not been verified in an IFS environment.

← Browse Security and access questions