7.2 Role-Based Security Groups: Constrained vs Unconstrained

7.2 Role-Based Security Groups: Constrained vs Unconstrained

Quick Answer: Role-Based Security Groups (RBSG) form the operational backbone of Workday security. Instead of assigning security permissions directly to individual user accounts, permissions are assigned to a security group that is linked to an Assignable Role (such as Manager, HR Partner, or Compensation Partner). When a worker is assigned to that role on an organization, they automatically inherit the security group's permissions. RBSGs are classified into two structural types: Constrained, which limits the user's data access strictly to workers within the assigned organization and its subordinate hierarchy; and Unconstrained, which grants tenant-wide access across all organizations without context boundaries. Assigning roles to Positions rather than individual workers preserves continuity during personnel turnover.

---

The Architecture of Role-Based Security Groups (RBSG)

In large global enterprises, maintaining user security manually is an administrative impossibility. Employees are hired, promoted, transferred between divisions, and separated daily. If administrators had to manually grant and revoke security permissions for every personnel transaction, security drift and unauthorized data access would be rampant.

Workday solves this challenge through Role-Based Security Groups (RBSG). In an RBSG:

1. Decoupled Architecture: Security permissions (View, Modify, Initiate, Approve) are granted to the Security Group via Domain and Business Process Security Policies.
2. Role Linkage: The security group is tied to an Assignable Role (e.g., HR Partner).
3. Dynamic Context Assignment: The assignable role is populated on an Organization (such as a Supervisory Organization, Cost Center, or Company) or assigned to a Position.
4. Runtime Resolution: When a user logs in, Workday's in-memory engine dynamically inspects the positions held by the user, discovers the assignable roles assigned to those positions, maps those roles to their governing security groups, and computes the user's exact operational permissions in real time.

+---------------------------------------------------------------------------------------------------+
|                                 ROLE-BASED SECURITY RESOLUTION                                    |
+---------------------------------------------------------------------------------------------------+
|                                                                                                   |
|  [ Worker: Marcus Vance ]                                                                         |
|          |                                                                                        |
|          v (Occupies Position)                                                                    |
|  [ Position: Senior HR Generalist (P-1042) ]                                                      |
|          |                                                                                        |
|          v (Assigned Role on Org)                                                                 |
|  [ Assignable Role: HR Partner on 'Western Regional Sales' Supervisory Org ]                      |
|          |                                                                                        |
|          v (Linked Security Group)                                                                |
|  [ Role-Based Security Group: HR Partner (Constrained) ]                                          |
|          |                                                                                        |
|          v (Governed by Policies)                                                                 |
|  [ Domain & BP Security Policies: Can view comp, initiate job changes, approve leaves ]            |
|          |                                                                                        |
|          v (Effective Scope)                                                                      |
|  RESULT: Marcus has HR Partner permissions ONLY for workers in 'Western Regional Sales'          |
|          and its subordinate teams!                                                               |
+---------------------------------------------------------------------------------------------------+

---

Assignable Roles on Organizations and Positions

An Assignable Role is a tenant-defined classification representing a specific functional hat or job responsibility that an individual or position wears with respect to an organization.

Delivered and Custom Assignable Roles

Workday delivers dozens of standard assignable roles, and organizations can create custom roles using the Maintain Assignable Roles task. Examples of ubiquitous assignable roles include:

• Manager: Automatically assigned to the position that leads a supervisory organization.
• HR Partner: Oversees general human resources management, employee relations, and staffing workflows.
• Compensation Partner: Administers salary grades, merit proposals, bonus payouts, and market adjustments.
• Talent Partner: Oversees succession plans, performance calibration, and talent reviews.
• Recruiting Partner: Manages job requisitions, candidate pipelines, and employment offers.
• Safety Officer: Manages worker incident reports and workplace safety compliance for physical work locations.

Target Organizations for Role Assignments

Assignable roles can be assigned to positions across multiple organization types, establishing different functional security perimeters:

• Supervisory Organizations: Governs reporting lines, worker lifecycle events, compensation reviews, and day-to-day managerial approvals.
• Cost Centers: Governs financial spend approvals, budget reviews, and labor costing visibility.
• Companies (Legal Entities): Governs corporate statutory compliance, tax reporting, and company-wide benefits policies.
• Locations / Regions: Governs regional compliance, facilities access, and localized safety reporting.

Assigning Roles to Positions vs. Workers (Best Practice)

Workday allows roles to be assigned either directly to an individual Worker or to a Position:

• Assigned to Worker: The role is tied to the worker's person record. If the worker moves to a new position, the role may follow them or require manual cleanup, creating operational overhead.
• Assigned to Position (Best Practice): The role is assigned to a position seat (e.g., Position #0052: HR Director). If the current incumbent leaves the company or transfers, the role remains anchored to the position. The moment a new worker is hired or transferred into that position, they instantly inherit all role assignments, security permissions, and pending inbox approvals without requiring a single security administration task.

---

Constrained vs. Unconstrained Security Groups

When creating a Role-Based Security Group via the Create Security Group task, the administrator must make an architectural decision: will the group be Constrained or Unconstrained? This setting dictates the boundary of the user's data access.

Constrained Role-Based Security Groups

A Constrained Security Group enforces contextual boundaries based on organizational assignments. The user's permissions apply only to the target population of workers belonging to the organization where the role is assigned (and its subordinates if inheritance is enabled).

• Target Population Boundary: If Sarah is assigned as HR Partner (Constrained) for the Engineering supervisory organization, she can view compensation, initiate transfers, and approve performance reviews strictly for workers inside Engineering. If she searches for a worker in Marketing, she cannot view their sensitive data or launch actions on their record.
• Principle of Least Privilege: Constrained security groups prevent cross-departmental data leakage and ensure privacy compliance under regulations like GDPR and CCPA.

Unconstrained Role-Based Security Groups

An Unconstrained Security Group utilizes the assignable role strictly as a mechanism for group membership, but does not restrict data access to the organization where the role is assigned. Once assigned the role, the user gains tenant-wide access across all workers and organizations.

• Tenant-Wide Scope: If David holds an assignable role linked to an Unconstrained Security Group, David can view data and execute actions across every employee in the entire enterprise, regardless of where David sits in the org chart.
• Typical Use Cases:
  • Executive Compensation Partner: Needs to review and calibrate executive compensation across all business units globally.
  • Global Benefits Administrator: Needs to manage benefits enrollments for all employees across all legal entities.
  • Corporate Compliance Auditor: Needs read-only access to personnel records across all international subsidiaries.

Constrained vs. Unconstrained Comparison Matrix

Exam Trap Alert: The constraint setting is established at the moment the security group is created and is permanently immutable. You cannot edit an existing security group and toggle it from Constrained to Unconstrained. To change the architectural type, an administrator must create a new security group, configure the policies, and transition role assignments.

---

Role Inheritance: Inherited vs. Specified Roles

To prevent administrators from having to manually assign roles at every individual branch and leaf of a massive supervisory hierarchy, Workday provides Role Inheritance.

Top-Down Inheritance Mechanics

When an administrator assigns a role on a supervisory organization using the Assign Roles task, they can check the "Inherit" setting:

• If enabled, the role assignment automatically cascades down the entire hierarchy tree to all subordinate supervisory organizations.
• Every worker positioned beneath that superior organization falls within the constrained security boundary of that role holder.

Specified (Local) Overrides

When a specific branch of an organization requires localized leadership or specialized HR support, an administrator can assign a Specified Role directly on the subordinate organization:

• The Override Rule: When a role is explicitly specified on a subordinate organization, it overrides and supplants the inherited role for that subordinate organization and all of its descendants.
• Operational Effect: The superior role holder no longer receives direct workflow tasks (such as hire approvals or compensation reviews) for that subordinate branch, routing those items instead to the local specified role holder.

+---------------------------------------------------------------------------------------------------+
|                                 ROLE INHERITANCE AND OVERRIDE                                     |
+---------------------------------------------------------------------------------------------------+
|  Top-Level: Global Enterprise (CEO Org)                                                           |
|  - HR Partner: Helena Troy (Position P-001) [Inherited = YES]                                     |
|         |                                                                                         |
|         +---------------------------------------+                                                 |
|         |                                       |                                                 |
|         v                                       v                                                 |
|  Division: Engineering                       Division: Sales & Marketing                          |
|  - HR Partner: (Inherited from Helena)       - HR Partner: Carlos Mendez (P-045) [SPECIFIED]       |
|         |                                       |                                                 |
|         v                                       v                                                 |
|  Team: Mobile Development                    Team: Enterprise Accounts                            |
|  - HR Partner: (Inherited from Helena)       - HR Partner: (Inherited from Carlos Mendez)         |
|                                                                                                   |
|  * Helena supports Engineering and Mobile    * Carlos supports Sales and Enterprise Accounts     |
|    Development via inheritance.                due to the local specified override.               |
+---------------------------------------------------------------------------------------------------+

---

Role Assignment Rules (Dynamic Role Assignment)

In addition to manual role assignments, Workday allows organizations to automate role population using Role Assignment Rules.

• Automated Rule Evaluation: Administrators configure conditional rules (e.g., "If Worker Location Country = United States AND Job Family = Engineering, assign to US Tech HR Partner").
• Tasks: Managed through Maintain Role Assignment Rules and evaluated during staffing transactions (such as Hire, Transfer, or Move Workers).
• Governance: Minimizes human error during rapid organizational reorganizations and mass hiring initiatives.

---

Step-by-Step Configuration: Creating and Assigning an RBSG

+---------------------------------------------------------------------------------------------------+
|                    ADMINISTRATIVE WORKFLOW: CONFIGURE ROLE-BASED SECURITY                         |
+---------------------------------------------------------------------------------------------------+
| Step 1: Create Security Group                                                                     |
|         Task: Create Security Group                                                               |
|         Select: 'Role-Based Security Group (Constrained)'                                         |
|         Name: 'HR Partner - North America'                                                        |
|                                                                                                   |
| Step 2: Link to Assignable Role                                                                   |
|         In 'Assignable Role', select 'HR Partner'                                                 |
|         Specify organization types that can support this role (e.g., Supervisory Organizations)   |
|                                                                                                   |
| Step 3: Configure Domain and Business Process Policies                                            |
|         Add 'HR Partner - North America' to permitted DSPs (View/Modify) and BPSPs (Initiate/Approve)|
|                                                                                                   |
| Step 4: Assign Role to Target Position                                                            |
|         Task: Navigate to target Supervisory Org -> Related Actions -> Organization -> Assign Roles|
|         Select 'HR Partner', select the target Position (e.g., P-1020), and check 'Inherit'       |
|                                                                                                   |
| Step 5: Activate Pending Security Policy Changes                                                  |
|         Run 'Activate Pending Security Policy Changes' with mandatory audit comment to commit.   |
+---------------------------------------------------------------------------------------------------+

---

Certification Pitfalls & Common Exam Traps

1. The Constrained vs. Unconstrained Definition Trap: An exam question will ask: "An HR Director needs to view compensation for every employee in the tenant regardless of supervisory organization, but should only initiate job changes for direct reports. What security group type is required for compensation visibility?" The answer is an Unconstrained Role-Based Security Group for the compensation domain, paired with a Constrained Role-Based Security Group for the business process policy.
2. The Worker vs. Position Reassignment Trap: A scenario describes an HR Specialist who held the HR Partner role on a critical supervisory org. When the specialist takes a leave of absence or transfers to another department, all pending approval tasks remain stuck in their personal inbox. The question asks how this should have been prevented: The role should have been assigned to a Position, not directly to the Worker.
3. The Inheritance Shadow Trap: If an administrator specifies an HR Partner locally on a child organization, the parent HR Partner does not get copied or merged into approval steps for that child organization; the local specified role completely overrides the inherited assignment for that branch.
4. Immutability of Group Type: An administrator cannot modify an existing Unconstrained Security Group and convert it to Constrained. The group must be recreated from scratch.