Security

Access Manager in Teamcenter: Rule-Based, Object-Based, Workflow in Teamcenter ACL Explained

By Pankaj Verma5 min read

A visual explanation of how Teamcenter controls access using rules, objects, and workflows — with precedence, practical Teamcenter steps, common mistakes, and a real project scenario.

9 min read Advanced security topic

Access Manager is the security brain of Teamcenter. It decides who can do what on which object — for example, who can read, edit, delete, approve, or release product data.

Simple meaning: ACL is permission control. It tells Teamcenter which user gets which level of access.

Three ACL types in a simple visual view

R

Rule-Based ACL

Default security behavior controlled by conditions such as group, role, ownership, or object type.

O

Object-Based ACL

Special access directly assigned to one specific object.

W

Workflow in Teamcenter ACL

Access that changes depending on workflow stage such as draft, review, or released.

What is Access Manager in Teamcenter?

Access Manager in Teamcenter is the central security engine that controls permissions on objects. It decides whether a user can read, modify, delete, or interact with data based on defined rules and conditions.

Quick comparison

ACL Type Best way to think about it Real use
Rule-Based Normal company-wide rule Engineering can edit, manufacturing can read
Object-Based Special exception for one object Confidential prototype only visible to a small team
Workflow in Teamcenter Stage-based lock or restriction Object becomes read-only during approval

Rule-Based ACL

This is the most common ACL type. It defines default access based on conditions such as user group, role, ownership, or object type.

Easy example: Engineering can edit Item Revisions, manufacturing gets read-only access, and suppliers get no access.

Object-Based ACL

This is used when one object needs stronger or different access than the normal system rule.

Example: a confidential engine prototype is restricted to only the project core team even though the normal rule allows wider Engineering access.

Workflow in Teamcenter ACL

This changes access based on workflow stage.

Which ACL takes precedence?

The more specific rule wins. The visual order below is the easiest way to remember it.

1
Object-Based ACL
Highest priority because it is most specific to one object.
2
Workflow in Teamcenter ACL
Next priority because stage-based control can restrict editing.
3
Rule-Based ACL
Default baseline security.
Which ACL takes precedence? diagram
Easy memory trick: Rule = normal, Workflow in Teamcenter = stage, Object = exception. Exception usually wins.

How to manage ACL in Teamcenter (step-by-step)

In real projects, ACL is not just theory. It is configured using Teamcenter tools like Access Manager, object properties, and Workflow in Teamcenter Designer.

Rule-Based ACL setup

Access Manager – Rule-Based ACL

Object Type: ItemRevision
ConditionGroup = Engineering
PermissionsRead ✔ | Write ✔ | Delete ✖
ConditionGroup = Manufacturing
PermissionsRead ✔ | Write ✖

Object-Based ACL setup

Object Properties – Access Control

Object: Engine_Prototype_001
Assigned ACLConfidential_Project_ACL
UsersProject_A_Team
PermissionsRead ✔ | Write ✔ | Others ✖

Workflow in Teamcenter ACL setup

Workflow in Teamcenter Designer – Access Control

Workflow in Teamcenter: Design Release
StageReview
AccessRead Only
StageReleased
AccessNo Modification
Always design ACL with real business roles in mind, not just system roles. A wrong ACL setup can block the wrong users or expose sensitive data.

Real project scenario: When ACL goes wrong (and how it was fixed)

In a real aerospace project, a company was developing a new engine component. Multiple departments were involved — design, manufacturing, and suppliers.

Everything was working fine until a small ACL mistake caused a major issue.

The problem

One engineer updated a critical design during the review phase. The design was already under approval workflow, but the system still allowed modification. The reviewer unknowingly approved the outdated version.

Root cause

The issue was not engineering discipline. The issue was incorrect ACL setup.

The fix

After the fix

After fixing ACL, the same process became stable, traceable, and error-free.

Common mistakes in ACL setup

Mistake

Overcomplicated rules

Too many conditions make the system difficult to debug and maintain.

Mistake

Ignoring precedence

Teams forget that object-based ACL can override broader rules and create unexpected results.

Mistake

Too many object-level ACLs

Using object ACL everywhere instead of strong rule-based logic creates long-term confusion.

Mistake

Workflow in Teamcenter not locking data

If workflow ACL is not configured, users may modify data during approval stages.

Mistake

No testing with real roles

ACL tested with admin users only often fails in production for actual business roles.

Mistake

Supplier access not controlled

External users can get unintended visibility when ACL design is weak or inconsistent.

A good ACL design is simple, predictable, and aligned with real business roles — not just system configuration.

Final summary