Question
How to Restrict SysAdmin role from changing code
Is there a way to restrict SysAdmin role so that they dont have access to the code but only can deploy the code using proudct import wizard?
If the only reason these Admins use Pega is to perform deployments, then they could use Deployment Manager (or a third-party DevOps orchestration suite) to perform deployments via API calls and eliminate their need for access to Dev Studio. As such, you could take Dev Studio off the portal list on their Access Group.
It's hard to imagine a role-based access control configuration that allows Modify (import) of rules whilst blocking Open, as this will surely block the Admins from being able to, for example, open the Studio and get to the Import wizard.
Hello,
on our side we created an admin like Access Group
in this one we restricted at role level capability to modify/save a rule, modify/save operator, same for Access Group, etc...
By granting a customized Admin AG you can restrict grants given to users while they're accessing dev portal. Then also make sure that they cannot update themselves their operator or the access groups.
Then as mentioned in other responses, you could consider full different approach for having the import done.
Regards
Anthony
@Khnb38
Don't have the access to the code? You mean not able to access any rules? I guess you will need some customization here maybe the easiest approach would be change the portal to hide unwanted options