Oracle Global Human Resources Cloud Release 12 Update 13 Page-Level Security O R A C L E W H I T E P A P E R M A Y 2 0 1 8
Global Human Resources Cloud Page-Level Security Table of Contents Introduction... 1 Objective... 1 Structure of Information... 1 Recommended Approach... 1 Use of Security the Console... 2 Worked Examples... 2 Removing an Aggregate Privilege... 2 Removing a Function Security Privilege from a Duty Role... 2 Common Function and Data Security Policies... 4 Simulate Navigator... 5 My Workforce: Person Management... 6 Person Search... 6 Personal and Employment... 7 Documents: Documents of Record & Document Delivery Preferences... 11 Workforce Modeling... 21 Workforce Predictions... 22 Absences... 23 My Workforce: Human Resources Dashboard... 24 Human Resources Dashboard... 24 My Workforce: Mass Updates... 26 Manage Mass Updates... 26
Create Mass Assignment Change... 27 My Workforce: Workforce Structures... 28 Manage Positions... 28 View Positions... 29 Create Position... 29 Manage Jobs... 30 Manage Grades... 30 Manage Grade Ladders... 31 Manage Grade Rates... 32 Manage Departments... 33 Manage Department Trees... 33 Manage Disability Organization... 34 Manage Divisions... 34 Manage Legislative Data Groups... 35 Manage Enterprise HCM Information... 35 Manage Organization Trees... 36 Manage Reporting Establishments... 37 Manage Locations... 37 Security Profiles... 38 Manage Organization Security Profiles... 39 Manage Position Security Profiles... 39 Manage Legislative Data Group Security Profiles... 40 Manage Country Security Profiles... 41 Manage Document Type Security Profiles... 41 Manage Data Roles and Security Profiles... 42 Manage Role Mappings... 43
Manage Collective Agreements... 43 Manage Actions... 44 Manage Action Reasons... 45 Manage Assignment Statuses... 45 Manage Approval Transactions... 46 My Workforce: New Person... 47 Overview... 47 Hire an Employee... 48 Add a Contingent Worker... 49 Add a Nonworker... 50 Add a Pending Worker (Process Selected (Taleo) Candidate as Pending Worker)... 51 Edit a Pending Worker... 52 My Team: My Team... 53 My Team... 53 Compare... 54 Change Location... 55 Change Manager... 55 Change Working Hours... 56 Information Sharing... 57 Manage Allocated Checklists... 57 Manage Direct Reports... 58... 59 Identifiers for External Applications... 59 Manage User Account... 60 Promote... 60
Terminate Work Relationship... 61 Reverse Terminate Work Relationship... 61 Correct Terminate Work Relationship... 62 Transfer... 62 Manage Document Records... 63 My Team: Manager Resources Dashboard... 64 Manager Resources Dashboard... 64 Reports and Analytics... 65 My Team: Workforce Modeling... 66 Overview... 66 My Team: Workforce Predictions... 68 Workforce Predictions... 68 My Team: Manage Users... 69 Search Person... 69 My Team: New Person... 71 Overview... 71 Hire an Employee... 72 Add a Contingent Worker... 72 Add a Nonworker... 73 Add a Pending Worker... 73 My Team: Document Records... 74 About Me: Personal Information... 75 My Details... 75 Edit My Details: Contact Information... 76 Edit My Details: Biographical Information... 77 Edit My Details: Contacts... 78
Edit My Details: Documents... 79 Edit My Details: Disabilities... 80 Manage Document Records... 80 Employment Details... 81 Submit Resignation... 81 Document Delivery Preferences... 82 About Me: My Portrait... 84 My Portrait... 84 About Me: My Account... 85 Edit User Account Details... 85 Directory: Person Gallery... 87 Search... 87 Directory: Directory... 88 Directory... 88 Tools... 89 Scheduled Processes... 89 Schedule New Process: Document Expiration Job... 89 Reports and Analytics... 90
Introduction This document is for customers, implementation consultants, and Oracle support engineers. Objective The predefined job and abstract roles may inherit roles that grant them access to work areas, pages, actions, or data that you do not want those roles to have. The recommended approach is to copy the relevant job or abstract role, such as Human Resource Specialist or Employee. You can then remove from the copied role the duty role or aggregate privilege that grants the role access to the work area, page, action, or data in question. The role simplification project, completed in Release 10, helped to identify duty roles and aggregate privileges by flattening the role hierarchy. However, in some cases it is still not obvious which duty roles or aggregate privileges secure a page or page content. The objective of this document is to identify the specific duty roles and aggregate privileges, and the functional and data security policies granted to them, that secure pages and their content so that you can add or remove that access, as appropriate. This document focuses on those work areas and pages owned by the Global Human Resources (Global HR) product team. Structure of Information The structure of this document is based on the Navigator menu options. This layout allows you to follow the Navigator to get to the page in question to determine the securing details. In some cases, the work area, page, action, or data is dependent on another aggregate privilege or duty role being present. For example, all tasks in the Person Management work area are dependent on the person search privilege. Therefore, if a role needs access to any of the tasks in the Person Management work area, then it must include the person search privilege. In this document, we list the securing attributes for a page once only and cross-refer when necessary. For example, the Identifiers for External Applications task is accessible from both the Person Management work area and the My Team actions menu. When you view the securing attributes section under the My Team navigation section, you are directed to the securing attributes section for the Person Management work area. The information is not repeated in the My Team section. Recommended Approach If you test user access with a user to which multiple roles are assigned, then you may find that page access is being granted by another role that inherits the relevant aggregate privilege or duty role. Therefore, you are strongly recommended to test with a user with only one role to confirm that the appropriate aggregate privileges or duty roles have been added or removed and that those changes have had the desired effect. In addition, you must understand the navigation used to arrive at the page, since that will help you to focus on the appropriate role. For example, if you navigate to My Team and are viewing the actions menu, then you should focus on the Line Manager role, since that is the only role that is granted access to My Team by default. 1
Use of Security the Console This document does not describe complete role hierarchies. Use the Security Console to identify which job and abstract roles inherit specific aggregate privileges and duty roles. For information about the Security Console, see the Securing Oracle HCM Cloud guide on the Oracle Help Center at https://docs.oracle.com/en/. Worked Examples Removing an Aggregate Privilege This example shows how to edit a custom Line Manager role to remove its access to the Identifiers for External Applications page. Use the Security Console. 1. Copy the predefined Line Manager role to create a custom role. 2. Edit the custom Line Manager role. On the Role Hierarchy page, search for the Identifiers for External Applications aggregate privilege. 3. Select the Identifiers for External Applications row and click the Delete icon. 4. After saving the edited custom role, assign security profiles to it using the Assign Security Profiles to Role task. 5. Assign the custom role to a user to test. Ensure that the user has no other roles. Removing a Function Security Privilege from a Duty Role This example shows how to remove access to the Manage Grades page from a custom Human Resource Specialist job role. Use the Security Console. 1. Search for and select the function security privilege Manage Assignment Grade. 2. Set Expand Toward to Users and click the Show Graph icon. 2
3. The screen shot shows that the Manage Assignment Grade function security privilege is granted to two predefined roles. For this use case, we are not concerned with the Compensation Administrator role. We are trying to identify how an HR Specialist inherits this privilege. 4. Right click on the Workforce Structures Management duty role and select Set as Focus to see which roles inherit this duty role. The following screen shot shows the inheritance. 5. As you can see in this screen shot, the Human Resource Specialist and Human Capital Management Application Administrator roles both inherit the duty role directly. 6. Right click the Human Resource Specialist job role and select Copy Role. 7. In the Copy Options dialog box, select the Copy top role and inherited roles option to create a deep copy of the role. 8. Submit and close the copied role. 3
9. Click the Role Copy Status subtab of the Administration tab to monitor the copy process to Complete status. 10. On the Roles tab, search for and select the copied Human Resource Specialist role. 11. Click the Show Graph icon to display a graphical view of the role. 12. Search for the custom Workforce Structures Management duty role that was created when you deep-copied the Human Resource Specialist role. 13. This duty role exists in multiple application stripes. Edit the Workforce Structures Management duty role with a role code that does not include _FSCM. 14. On the Function Security Policies page, search for and select the Manage Assignment Grade function security privilege. Click the Delete icon and save your changes. 15. Create a data role for your custom Human Resource Specialist role. 16. Assign the data role to a user to test. Ensure that the user has no other roles. Common Function and Data Security Policies The recommended way to create a custom role is to copy a predefined role and remove any unwanted aggregate privileges or duty roles. With this approach, the copied role inherits data security policies that provide access to many secured lists of values, for example, lists of departments or positions. In most situations, there should be no need to delete these data security policies from the copied role. In some cases, you may create a role from scratch and not include a required data security policy. In other cases, you may delete data security policies from a copied role because you do not believe that the data security policy is required. In both cases, the result of the missing data security policy may be that the role is unable to view secured data in the list of values. This table identifies the data security policies for the most frequently used lists of values that should be included in a role. It also identifies the security profile that secures those objects. Data Resource Privilege Security Profile Example LOV FND_TERRITORIES_B Choose Application Reference Territory Country National Identifier Country Assignment Grade - PER_GRADES_F Choose Assignment Grade No security profile Manage Employment: Grade Organization - HR_ALL_ORGANIZATION_UNITS_F Choose Business Unit Organization Organization Manage Employment: Business Unit Organization - HR_ALL_ORGANIZATION_UNITS_F Choose Department Organization Manage Employment: Department 4
Data Resource Privilege Security Profile Example LOV HR Job - PER_JOBS_F Choose HR Job No security profile Manage Employment: Job Organization Details - HR_ALL_ORGANIZATION_UNITS_F Choose Legal Employer Organization Hire an Employee: Legal Employer Legislative Data Group - PER_LEGISLATIVE_DATA_GROUPS Choose Legislative Data Group Legislative Data Group Manage Grade Rates: Legislative Data Group Location - PER_LOCATIONS Choose Location No security profile Manage Employment: Location Payroll Definition - PAY_ALL_PAYROLLS_F Choose Payroll Payroll Hire an Employee: Payroll Position - HR_ALL_POSITIONS_F Choose Position Position Public Person - PER_PERSONS Choose Public Person Public Person Manage Employment: Position Create Contact: Existing Person Person Work Terms Assignment - PER_ALL_ASSIGNMENTS_M Choose Worker Person Person Detail Person Search Live Data Person Detail Person Management Search This table identifies the function security policy for approvals that should be included in a role. Function Security Policy Privilege Name Approve Transactions We recommend that you grant this function security policy to all custom roles. Simulate Navigator Use Simulate Navigator on the Security Console to identify the function security privileges that secure menu entries in the navigator and the roles that have access to navigator menu entries. Simulate Navigator also shows the privileges that secure tasks in Tasks panel tabs. See Simulating Navigator Menus: Procedure in the Securing HCM guide for more information. Some Oracle HCM Cloud pages have components such as regions and buttons that are secured using function or data security policies that are not within the scope of Simulate Navigator. These policies are covered in this document. 5
My Workforce: Person Management Person Search 6
Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Search Person Search Person Live Data Person Detail - PER_ALL_PEOPLE_F The person security profile determines which people are returned in the person management search results. Personal and Employment Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Manage Person Person Detail - PER_ALL_PEOPLE_F View Person View Person Data This privilege does not grant access to the Edit buttons, which makes this a read-only page. Security of the data on the page: Data Security Policies Tab, Region, or Field Privilege Data Resource Roles Names Person Detail - PER_ALL_PEOPLE_F Person Management National Identifiers National Identifier Person National Identifier - PER_NATIONAL_IDENTIFIER Person Management 7
Data Security Policies Tab, Region, or Field Privilege Data Resource Roles National Identifiers View Person National Identifier Person National Identifier - PER_NATIONAL_IDENTIFIER Person National Identifier View Workforce Confidential Viewing Disability Disability Person Disability - PER_DISABILITIES_F Person Management Disability Disability by Worker Disability View Person Disability Person Detail - PER_ALL_PEOPLE_F Person View Duty Driver s License Driver License Number Person Driver License - PER_DRIVERS_LICENSES Person Management Driver s License View Person Driver License Number Person Driver License - PER_DRIVERS_LICENSES Workforce Confidential Viewing Passport Passport Number Person Passport - PER_PASSPORTS Person Management Passport View Person Passport Person Passport - PER_PASSPORTS Workforce Confidential Viewing Address Private Address Details Person Address for Table PER_PERSON_ADDR_USAGES_F Person Management View Portrait Personal Information Card Address View Person Address Person Address for Table PER_PERSON_ADDR_USAGES_F Person View Address Workforce Confidential Viewing Visa/Work Permit Visa Number or Work Permit Person Visa - PER_VISAS_PERMITS_F Person Management Visa/Work Permit View Person Visa Person Visa - PER_VISAS_PERMITS_F Workforce Confidential Viewing E-Mail Email Person Email - PER_EMAIL_ADDRESSES Person Communication Methods Management E-Mail View Person Email Person Email - PER_EMAIL_ADDRESSES Person Communication Methods View Workforce Confidential Viewing Phone Phone Person Phone - PER_PHONES Person Communication Methods Management 8
Data Security Policies Tab, Region, or Field Privilege Data Resource Roles Phone View Person Phone Person Phone - PER_PHONES Person Communication Methods View Workforce Confidential Viewing Other Communication Method Communication Method Person Communication Method - PER_PERSON_DLVRY_METHODS Person Communication Methods Management Other Communication Method View Person Communication Method Person Communication Method - PER_PERSON_DLVRY_METHODS Person Communication Methods View Workforce Confidential Viewing Legislative Information Country LOV Choose Application Reference Territory FND_TERRITORIES_B Person Management Line Manager Tab, Region, or Field Aggregate Privilege Contacts Manage Contact Person PII Security of the buttons on the page. Button Privilege Data Resource Roles Edit Name Person Detail - PER_ALL_PEOPLE_F Person Management Edit Address Private Address Details Person Detail - PER_ALL_PEOPLE_F Person Management View Portrait Personal Information Card Create Address Private Address Details Person Detail - PER_ALL_PEOPLE_F Person Management View Portrait Personal Information Card Edit E-Mail Details Email Person Detail - PER_ALL_PEOPLE_F Person Communication Methods Management Edit Phone Details Phone Person Detail - PER_ALL_PEOPLE_F Person Communication Methods Management Edit Other Communication Accounts Communication Method Person Detail - PER_ALL_PEOPLE_F Person Communication Methods Management Edit National Identifiers Person Detail - PER_ALL_PEOPLE_F Person Management Edit Biographical Information Person Detail - PER_ALL_PEOPLE_F Person Management 9
Button Privilege Data Resource Roles Add Country Person Detail - PER_ALL_PEOPLE_F Person Management Edit Legislative Information Person Detail - PER_ALL_PEOPLE_F Person Management Create Contact Person Detail - PER_ALL_PEOPLE_F Person Management Create From Existing Person Person Detail - PER_ALL_PEOPLE_F Person Management Edit Contact Person Detail - PER_ALL_PEOPLE_F Person Management Delete Contact Person Detail - PER_ALL_PEOPLE_F Person Management Edit Citizenships Person Detail - PER_ALL_PEOPLE_F Person Management Create Driver Licenses Person Detail - PER_ALL_PEOPLE_F Person Management Edit Driver Licenses Person Detail - PER_ALL_PEOPLE_F Person Management Delete Driver Licenses Person Detail - PER_ALL_PEOPLE_F Person Management Edit Passports Person Detail - PER_ALL_PEOPLE_F Person Management Create Visas and Permits Person Detail - PER_ALL_PEOPLE_F Person Management Edit Visas and Permits Person Detail - PER_ALL_PEOPLE_F Person Management Delete Visas and Permits Person Detail - PER_ALL_PEOPLE_F Person Management Create Document Records Person Detail - PER_ALL_PEOPLE_F Person Management Edit Document Records Person Detail - PER_ALL_PEOPLE_F Person Management Delete Document Records Person Detail - PER_ALL_PEOPLE_F Person Management Create Disability Person Detail - PER_ALL_PEOPLE_F Person Management Edit Disability Person Detail - PER_ALL_PEOPLE_F Person Management Delete Disability Person Detail - PER_ALL_PEOPLE_F Person Management Edit Extra Information Person Detail - PER_ALL_PEOPLE_F Person Management 10
Documents: Documents of Record & Document Delivery Preferences See Manage Document Records under My Team: Document Records Identifiers for External Applications 11
Aggregate Privilege Identifiers for External Applications View Person Identifiers for External Applications This privilege does not grant access to the Edit buttons, which makes this a read-only page. Compare Aggregate Privilege Compare HCM Information 12
Manage Employment Aggregate Privilege Manage Work Terms and Assignment View Work Terms and Assignment This privilege does not grant access to the Edit buttons, which makes this a read-only page. Manage User Account 13
Aggregate Privilege Manage User Account See Common Function and Data Security Policies for information about policies that secure common list of values. Create Work Relationship, Rehire an Employee, Renew Placement Note: This process flow is the same for all three flows but, depending the launching point, it would use different function privileges and show an appropriate page title. Aggregate Privilege Create Work Relationship Create Work Relationship is the flow title when the flow is launched from the Person Search Results Actions menu. Function Security Policies Privilege Name Data Security Policies Privilege Data Resource Rehire Employee Choose Person Type Person Type for Table PER_PERSON_TYPES Rehire an Employee is the flow title when the flow is launched by selecting an existing person record from Duplicate Search results after entering Basic Information in the Hire an Employee process. Renew Placement Choose Person Type Person Type for Table PER_PERSON_TYPES Renew Placement is the flow title when the flow is launched by selecting an existing person record from Duplicate Search results after entering Basic Information in the Add a Contingent Worker process. 14
Security of the data on the page: Data Security Policies Tab, Region, or Field Privilege Data Resource Roles Names Person Detail - PER_ALL_PEOPLE_F Person Management National Identifiers National Identifier Person National Identifier - PER_NATIONAL_IDENTIFIER Person Management National Identifiers View Person National Identifier Person National Identifier - PER_NATIONAL_IDENTIFIER Person National Identifier View Workforce Confidential Viewing Address Private Address Details Person Address for Table PER_PERSON_ADDR_USAGES_F Person Management View Portrait Personal Information Card Address View Person Address Person Address for Table PER_PERSON_ADDR_USAGES_F Person View Address Workforce Confidential Viewing Visa/Work Permit Visa Number or Work Permit Person Visa - PER_VISAS_PERMITS_F Person Management Visa/Work Permit View Person Visa Person Visa - PER_VISAS_PERMITS_F Workforce Confidential Viewing E-Mail Email Person Email - PER_EMAIL_ADDRESSES Person Communication Methods Management E-Mail View Person Email Person Email - PER_EMAIL_ADDRESSES Person Communication Methods View Workforce Confidential Viewing Phone Phone Person Phone - PER_PHONES Person Communication Methods Management Phone View Person Phone Person Phone - PER_PHONES Person Communication Methods View Workforce Confidential Viewing Tab, Region, or Field Contacts Aggregate Privilege Manage Contact Person PII This privilege is needed only to see an existing contact, not for creating a new contact. 15
Manage Work Relationship Aggregate Privilege Manage Work Relationship View Work Relationship This privilege does not grant access to the Edit buttons, which makes this a read-only page. Manage Seniority Dates 16
Aggregate Privilege Manage Seniority Dates Manage Direct Reports Aggregate Privilege Manage Direct Report 17
Manage Areas of Responsibility Aggregate Privilege Manage Areas of Responsibility by Person View Areas of Responsibility by Person This privilege does not grant access to the Edit buttons, which makes this a read-only page. Manage Document Records See Manage Document Records under My Workforce: Document Records 18
Manage Allocated Checklists Aggregate Privilege Manage Worker Checklist View Worker Checklist This privilege does not grant access to the Edit buttons, which makes this a read-only page. Manage Talent Profile 19
Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Roles Define Talent Profile Define Talent Profile Item Talent Profile Search Talent Profile Update Talent Profile Item View Talent Profile View Talent Profile Person Data View Talent Profile Item HR Specialist Data View Person Skills and Qualifications View Person Skills and Qualifications Data PER_PERSONS - Public Person Employee Abstract Role Contingent Worker Abstract Role Line Manager Abstract Role Human Resource Specialist Job Role Edit Person Skills and Qualifications Edit Person Skills and Qualifications Data PER_ALL_PEOPLE_F - Person Detail Employee Abstract Role Contingent Worker Abstract Role Line Manager Abstract Role Human Resource Specialist Job Role 20
Workforce Modeling 21
Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Manage Workforce Model Plan as HR Specialist Choose Public Person Public Person Edit Workforce Model Plan Manage Workforce Model Plan Workforce Model Plan Edit Workforce Model Plan allows approvers who are HR Specialists to edit the model they are approving. Security of the data on the page: Tab, Region, or Field Aggregate Privilege Salary View Salary Data Only To view salary for people defined by the person security profile. Salary Manage Salaries To edit salary. Workforce Predictions Aggregate Privilege View Workforce Predictions as Line Manager Out-of-the-box, the Human Resource Specialist does not have access to the Workforce Predictions work area. See the release notes for a workaround for Release 12. Removing this aggregate privilege hides Workforce Predictions for the line manager. 22
Absences Manage Absence Cases Aggregate Privilege Manage Absence Case 23
My Workforce: Human Resources Dashboard Human Resources Dashboard 24
Aggregate Privilege Report Human Resources Transaction Dashboard 25
My Workforce: Mass Updates Manage Mass Updates 26
Function Security Policies Privilege Name Manage Mass Updates Work Area Create Mass Assignment Change Function Security Policies Privilege Name Worker Mass Assignment Change Perform Worker Mass Transfer This privilege will eventually be obsoleted. 27
My Workforce: Workforce Structures Manage Positions 28
Aggregate Privilege Maintain Positions Use the position security profile to secure positions. View Positions Aggregate Privilege View Positions Use the position security profile to secure positions. Create Position Function Security Policies Privilege Name Create Position 29
Manage Jobs Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Manage HR Job Manage HR Job HR Job for Table PER_JOBS_F Although the data security policies need to be present in order to see data in the UIs, they allow unrestricted access to all jobs. Manage Grades 30
Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Manage Assignment Grade Manage Assignment Grade Assignment Grade for Table - PER_GRADES_F Although the data security policies need to be present in order to see data in the UIs, they allow unrestricted access to all grades. Manage Grade Ladders Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Manage Assignment Grade Ladder Manage Assignment Grade Ladder Data Assignment Grade Ladder for Table PER_GRADE_LADDER_F Although the data security policies need to be present in order to see data in the UIs, they allow unrestricted access to all grade ladders. 31
Manage Grade Rates Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Manage Assignment Grade Rate Manage Assignment Grade Rate Data Assignment Grade Pay Rate for Table PER_RATES_F Although the data security policies need to be present in order to see data in the UIs, they allow unrestricted access to all grade rates. The Manage Grade Rates page can also be accessed via a button on the Create Grade page. The Create Grade page is secured by the Manage Assignment Grade privilege. 32
Manage Departments Aggregate Privilege Manage Departments Use the organization security profile to secure departments. Manage Department Trees Function Security Policies Privilege Name Manage Department Tree 33
Manage Disability Organization Function Security Policies Privilege Name Manage Disability Organization Manage Divisions Aggregate Privilege Manage Divisions Use the organization security profile to secure divisions. 34
Manage Legislative Data Groups Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Manage Legislative Data Group Manage Legislative Data Group Legislative Data Group for Table PER_LEGISLATIVE_DATA_GROUPS Use the organization security profile to secure legislative data groups. Manage Enterprise HCM Information 35
Function Security Policies Privilege Name Manage Enterprise HCM Information Manage Organization Trees Function Security Policies Privilege Name Manage Organization Tree 36
Manage Reporting Establishments Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Manage Reporting Establishment Manage Reporting Establishment Organization for Table HR_ALL_ORGANIZATION_UNITS_F Use the organization security profile to secure reporting establishments. Manage Locations 37
Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Manage Location Manage Location Location for Table PER_LOCATIONS Although the data security policies need to be present in order to see data in the UIs, they allow unrestricted access to all locations. Security Profiles Function Security Policies Privilege Name Security Profile 38
Manage Organization Security Profiles Function Security Policies Privilege Name Manage Organization Security Profile Manage Position Security Profiles 39
Function Security Policies Privilege Name Manage Position Security Profile Manage Legislative Data Group Security Profiles Function Security Policies Privilege Name Manage Legislative Data Group Security Profile 40
Manage Country Security Profiles Function Security Policies Privilege Name Manage Country Security Profile Manage Document Type Security Profiles 41
Function Security Policies Privilege Name Manage Document Type Security Profile Manage Data Roles and Security Profiles Function Security Policies Privilege Name Manage HCM Data Role 42
Manage Role Mappings Function Security Policies Privilege Name Manage HCM Role Provisioning Rules Manage Collective Agreements 43
Function Security Policies Privilege Name Manage Collective Aggrements This spelling mistake appears in the privilege name. Manage Actions Function Security Policies Privilege Name Manage Employment Action Reason 44
Manage Action Reasons Function Security Policies Privilege Name Manage Employment Action Reason Manage Assignment Statuses 45
Function Security Policies Privilege Name Manage Employment Action Reason Manage Approval Transactions Function Security Policies Privilege Name Perform HCM Approval Transaction Actions Review HCM Approval Transactions Manage Approval Rules Allows maintenance of failed transaction processes, such as recovering, withdrawing, and sending back failed processes. Allows viewing of basic information, such as failed processes, for the HCM approval transaction processes. Allow management of HCM approval rules. 46
My Workforce: New Person Overview Function Security Policies Privilege Name New Person Work Area New Person Work Area as Line Manager 47
Security of the buttons on the page: Function Security Policies Button Aggregate Privilege Privilege Convert Hire Pending Worker Quick Convert Pending Worker Quick Hire Hire an Employee Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Hire Employee Choose Person Type Person Type for Table PER_PERSON_TYPES See Create Work Relationship, Rehire an Employee, Renew Placement for the data security policies used to secure regions in the Rehire an Employee pages. 48
Add a Contingent Worker Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Add Contingent Worker Choose Person Type Person Type for Table PER_PERSON_TYPES Add Contingent Worker Person Detail - PER_ALL_PEOPLE_F See Create Work Relationship, Rehire an Employee, Renew Placement for the data security policies used to secure regions in the Renew Placement pages. 49
Add a Nonworker Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Create Person Nonworker Choose Person Type Data For Choose Person Type: Person Type for Table PER_PERSON_TYPES 50
Add a Pending Worker (Process Selected (Taleo) Candidate as Pending Worker) Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Add Worker Pending Hire Choose Person Type Person Type for Table PER_PERSON_TYPES Correct Oracle Taleo Recruiting Candidate Import Errors Correct Oracle Taleo Recruiting Candidate Import Errors Pending Worker Import Error for Table HRC_DL_CANDIDATE_IMPORTS Candidate access is based on the person security profile. Having this function privilege when the enterprise setting Recruiting Integration is set to Integrated with HCM Connect will display this tab. See Create Work Relationship, Rehire an Employee, Renew Placement for data security policies used to secure regions in the Rehire Pending Worker pages. 51
Edit a Pending Worker Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Edit Pending Worker Edit Pending Worker Data Person Name Choose Person Type Data Person Type for Table PER_PERSON_TYPES 52
My Team: My Team My Team 53
Aggregate Privilege Function Security Policy (Privilege Name) Access FUSE My Team Page Not seeing any data on My Team? My Team is based on the manager hierarchy. It is not based on the security profile configuration. The manager hierarchy must be denormalized to show data in My Team. This should occur automatically, but you can also run the Refresh Manager Hierarchy process to denormalize the hierarchy. Once this process completes, you should see the hierarchy on the My Team page. From this set of person records, the set of those for whom you can perform specific actions depends on your roles and the person security profiles assigned to those roles. Access Person Gallery This privilege is required for My Team to appear on the Navigator. The data privilege allows data to be displayed. Compare See Compare under My Workforce: Person Management for details. 54
Change Location Aggregate Privilege Change Worker Location Change Manager 55
Aggregate Privilege Change Worker Manager Change Working Hours Aggregate Privilege Change Worker Working Hour 56
Information Sharing Aggregate Privilege Manage Worker Information Sharing Manage Allocated Checklists 57
See Manage Allocated Checklists under My Workforce: Person Management for details. Manage Direct Reports Aggregate Privilege Manage Direct Report 58
See under My Workforce: Person Management for details. Identifiers for External Applications See Identifiers for External Applications under My Workforce: Person Management for details. 59
Manage User Account See Manage User Account under My Workforce: Person Management for details Promote 60
Aggregate Privilege Promote Worker Terminate Work Relationship Aggregate Privilege Terminate Work Relationship Reverse Terminate Work Relationship (Reverse Termination button) Aggregate Privilege Reverse Work Relationship Termination 61
Correct Terminate Work Relationship Aggregate Privilege Correct Work Relationship Termination Transfer 62
Aggregate Privilege Transfer Worker Manage Document Records Aggregate Privilege Documentation 63
My Team: Manager Resources Dashboard Manager Resources Dashboard 64
Aggregate Privilege Report Manager Transaction Dashboard Reports and Analytics See Reports and Analytics under Tools for details. 65
My Team: Workforce Modeling Overview 66
Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Manage Workforce Model Plan as Line Manager Choose Public Person Public Person Manage Workforce Model Plan Workforce Model Plan Security of the data on the page: Tab, Region, or Field Aggregate Privilege Privilege Data Resource Role Salary View Salary Data Only To view salary for people defined by the salary profile. Salary Manage Salaries To edit salary. Top Manager Create Workforce Model Plan Person Detail Workforce Model Plan Line Manager In the Create Model dialog box, allows you to restrict for whom a user can create models. 67
My Team: Workforce Predictions Workforce Predictions Aggregate Privilege View Workforce Predictions as Line Manager 68
My Team: Manage Users Search Person Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Manage Users Manage Users Person Detail - table PER_ALL_PEOPLE_F 69
Security of the data on the page: Data Security Policies Tab / Region / Field Privilege Data Resource Roles User Account Details Manage Users Person Detail - PER_ALL_PEOPLE_F Manage Users See also Manage User Account under My Workforce: Person Management. 70
My Team: New Person Overview See Overview under My Workforce: New Person for details. 71
Hire an Employee See Hire an Employee under My Workforce: New Person for details. Add a Contingent Worker See Add a Contingent Worker under My Workforce: New Person for details. 72
Add a Nonworker See Add a Nonworker under My Workforce: New Person for details. Add a Pending Worker See Add a Pending Worker (Process Selected (Taleo) Candidate as Pending Worker) under My Workforce: New Person for details. 73
My Team: Document Records See Manage Document Records (My Team). 74
About Me: Personal Information My Details Function Security Policies Privilege Name Access FUSE Personal Information Page 75
Security of the data on the page: Data Security Policies Tab, Region, or Field Privilege Data Resource Roles Edit Button Phone Person Phone - PER_PHONES Person Communication Methods Management Edit Button Email Person Email - PER_EMAIL_ADDRESSES Person Communication Methods Management Edit Button Communication Method Person Communication Method - PER_PERSON_DLVRY_METHODS Person Communication Methods Management Tab, Region, or Field Aggregate Privilege Edit Button Edit Button Edit Button Edit Button View Portrait Personal Information Card Change Person Marital Status Documentation by Worker Disability by Worker Edit My Details: Contact Information 76
Aggregate Privilege View Portrait Personal Information Card Allows access to the Contacts tab address region. The Contacts tab appears if the user has this data security policy. Security of the data on the page: Data Security Policies Tab, Region, or Field Privilege Data Resource Roles Edit Button Phone Person Phone - PER_PHONES Person Communication Methods Management Edit Button Email Person Email - PER_EMAIL_ADDRESSES Person Communication Methods Management Edit Button Communication Method Person Communication Method - PER_PERSON_DLVRY_METHODS Person Communication Methods Management Edit My Details: Biographical Information 77
Aggregate Privilege Change Person Marital Status Name Ethnicity Religion Allows access to the Biographical Information tab marital status region. The Biographical Information tab appears if the user has this data security policy. Allows access to the Biographical Information tab name region. The Biographical Information tab appears if the user has this data security policy. Allows access to the Biographical Information tab ethnicity region. The Biographical Information tab appears if the user has this data security policy Allows access to the Biographical Information tab religion region. The Biographical Information tab appears if the user has this data security policy. Edit My Details: Contacts Aggregate Privilege View Portrait Personal Information Card Allows access to the Contacts tab. 78
Edit My Details: Documents Aggregate Privilege Citizenship Passport Visa or Permit Driver License Allows access to the Documents tab citizenship region. The Documents tab appears if the user has this data security policy. Allows access to the Documents tab passport region. The Documents tab appears if the user has this data security policy. Allows access to the Documents tab visa or permit region. The Documents tab appears if the user has this data security policy. Allows access to the Documents tab driver s license region. The Documents tab appears if the user has this data security policy. 79
Edit My Details: Disabilities Aggregate Privilege Disability by Worker Manage Document Records Aggregate Privilege Documentation by Worker 80
Employment Details Aggregate Privilege View Employment Information Summary Submit Resignation 81
Aggregate Privilege Submit Resignation Document Delivery Preferences 82
Aggregate Privilege Documentation by Worker 83
About Me: My Portrait My Portrait Aggregate Privilege Access Person Gallery 84
About Me: My Account Edit User Account Details 85
Aggregate Privilege Manage My Account 86
Directory: Person Gallery Search Aggregate Privilege Access Person Gallery The public person security profile determines which people are returned in the directory search results. 87
Directory: Directory Directory Function Security Policies Data Security Policies Privilege Name Privilege Data Resource Access FUSE Directory Page Search Person Deferred Public Person The public person security profile determines which people are returned in the directory search results. 88
Tools Scheduled Processes Schedule New Process: Document Expiration Job Aggregate Privilege Documentation Reporting Allows processing of the expiration of document records. 89
Reports and Analytics Aggregate Privilege Manage Reports and Analytics For more information, see Oracle Fusion Transactional Business Intelligence Security: Explained in the Securing HCM guide. Additional information can be found in document 2023155.1 on My Oracle Support. 90
Oracle Corporation, World Headquarters Worldwide Inquiries 500 Oracle Parkway Phone: +1.650.506.7000 Redwood Shores, CA 94065, USA Fax: +1.650.506.7200 C O N N E C T W I T H U S blogs.oracle.com/oracle facebook.com/oracle twitter.com/oracle oracle.com Copyright 2018, Oracle and/or its affiliates. All rights reserved. This document is provided for information purposes only, and the contents hereof are subject to change without notice. This document is not warranted to be error-free, nor subject to any other warranties or conditions, whether expressed orally or implied in law, including implied warranties and conditions of merchantability or fitness for a particular purpose. We specifically disclaim any liability with respect to this document, and no contractual obligations are formed either directly or indirectly by this document. This document may not be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without our prior written permission. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. 0518 Oracle May 2018