Policy Managers¶

Group id 102, stored as [Policy Managers], enum value enum_IR.AdmistrativeRoles.PolicyManager (IRBase\IRBaseEnum.cs). The role is for the application-wide settings (general, authentication and password, system behaviour, e-mail and notification, default folder columns) and for the policies of every library. It is a system group: it belongs to no library (DOMAINID 0, setup\PatchLibrary\...\Update_8_2_000_updater.cs), and only Administrators can add or remove its members. IRSecurity.IsAllowed gives UpdateGroupMembers no role and no library-manager pass for a group id up to IRConstants.LastSystemUserGroupId (1000), so only the administrator check at the top of AccessAllowedforAdminFunctionsAsync lets a member change.

How the role is checked¶

Three entries of the IRSecurity.IsAllowed matrix name the role (IRNET\IRSecurity.cs):

Order of the decision (IRSecurity.AccessAllowedforAdminFunctionsAsync, then IsAllowed):

1. An administrator (ThreadVariables.IsAdministrator(): the sysadmin account or a member of [Administrators]) passes everything.
2. Self-service: none of the three actions allows it.
3. Membership of a required role group (UsergroupMembersStore.IsMemberOfAnyGroupAsync).
4. Library managers, only when the action allows them and a library id above 0 was passed (SecurityFunctions.CheckDomainManagementAsync, IRNET\ModuleSecurityFunctions.cs). The settings calls pass localDomainId 0, so no library manager ever passes them.

A refusal is errorCode="4030" with the message Access denied. This action is restricted to the following roles: The system administrator, Policy managers (Messages.AccessDenied, ActionRestrictedToFollowingRoles, TheSystemAdministrator, PolicyManagers). For a library policy change with the setting on, Library manager(s) is listed as well.

Administrators always pass every check below; the tables do not repeat it.

What the role can do¶

Application settings¶

All of these call AccessAllowedforAdminFunctionsAsync(UpdateApplicationSettingsAndPolicies, UNSPECIFIED, 0, 0) first.

Library policies¶

Settings reads that need no role¶

These are listed so the UI does not hide them from anyone; they are not what the role unlocks.

What the role cannot do¶

Finding out whether the signed-in user has this role¶

• GetGroupMembershipsOfUser with the caller's own name: ListingGroupMembershipOfUser allows self (UserServices.cs:992, User.AccessAllowedForUserAsync passes USER and the user's id). A GroupID of 102 in the answer is this role; 104 is an administrator, who passes every check on this page without being in group 102.
• GetLibrariesForAdministration: every library for a Policy Manager, User Manager or administrator; only the managed ones for a library manager; empty for anyone else. It does not say which of the three the caller is.
• GetSystemBehaviorSettings succeeds only for a Policy Manager or an administrator, so a 4030 from it means the caller is neither.
• getApplicationParameters: the SMTPSERVER or WarehousePaths element is present only for an administrator; it says nothing about this role.

Notes¶

• The flag that lets library managers edit policies is itself a Policy Manager setting. AllowLibraryManagersToEditPolicy is part of the system behaviour settings (SetSystemBehaviorSettings), so a Policy Manager decides whether library managers may change their libraries' policies. Reading policies does not depend on it (Domain.AccessAllowedToReadPoliciesAsync).
• Reading a library's policies, by whom. A Policy Manager and a library's managers read them; a plain member of the library gets 4030; a non-member who is not a Policy Manager, User Manager or manager of that library gets 4041 Library not found from the lookup, before the policy check. The 4030 message for a member names Library manager(s) only when the edit flag is on, because IsAllowed lists library managers only when it would have let them pass.
• Library lookup by name. Commit 61e1fb36 (2026-10-21) gave DomainOperations.GetLibraryByNameAsync and GetLibraryByIdAsync the same MayReachAsync rule: members, anonymous-access libraries, then ListLibrariesForAdministration with the library's id. A Policy Manager therefore reaches any library by name, member or not. GetLibrariesForAdministration itself was added by commit fdd53cf9 (2026-10-21); the test GetLibrariesForAdministrationApiTests.APolicyManager_GetsEveryLibraryToo covers the role.
• Refusals of the anonymous user differ by code. With no ticket, GetGeneralAppSettings and GetAuthenticationAndPasswordPolicy answer 4010 (explicit IsAuthenticatedUser() check), while GetSystemBehaviorSettings, GetEmailAndNotificationSettings, the four Set* settings calls and FlushApplicationCache answer 4030 (the matrix refuses the anonymous user like any non-member). The test AppSettingsBatchApiTests.WithoutATicket_EachOneIsRefused_ButNotAllTheSameWay records this. A UI should treat 4010 and 4030 alike for these.
• Every settings writer checks twice. The SettingServices method checks UpdateApplicationSettingsAndPolicies, and the InfoRouterExtensions method it calls (or InfoRouter.SaveSystemDefaultColumnSettings for the columns) checks it again. Same action, same answer; the second check is for callers inside IRNET.
• getApplicationParameters and the settings readers overlap. The extended block shows LOGLOGINS and the PWD* values to administrators only, yet a Policy Manager reads the same values through GetSystemBehaviorSettings, and any signed-in user through GetAuthenticationAndPasswordPolicy. Nothing is hidden by it that a dedicated reader does not give, except the SMTP server details, server name, IP addresses and warehouse paths, which no settings call exposes. Defensible: the block is infrastructure, not policy.
• ListLibrariesForAdministration is shared with User Managers and is what MayReachAsync and GetLibrariesForAdministration use. It no longer widens getTasks: WorkflowOperations.GetTasksAsync reads the administrator flag and DomainsStore.GetLibraryListForAdministrationAsync (managed libraries) directly, so User and Policy Managers see only their own tasks.

Related¶

• AdministrativeRoles, all roles at a glance
• the other role pages: Administrators, User Managers, Audit Managers, R&D Managers, Search & Category Administrators, Library Managers