Permission List Table Access Report

Permission List Table Access Report

Report ID: security-permlist-table-access Category: Security Parameters: classid (required) — the PeopleSoft Permission List (CLASSID) to audit

Purpose

This report maps a single PeopleSoft Permission List (CLASSID) to every SQL Table and View (PSRECDEFN) it grants Update or Read access to, and traces each record back to the exact sources that grant that access:

• Components & Pages (PSAUTHITEM → PSMENUITEM → PSPNLGRPDEFN / PSPNLGROUP → PSPNLFIELD with nested subpages/secondary pages expanded and subrecords resolved)
• Component Interfaces (PSAUTHBUSCOMP → PSBCITEM collections and properties)
• Query Access Trees (SCRTY_ACC_GRP → PSTREENODE leaf records)

Access Classification Rules

Only persistent SQL Tables (RECTYPE IN (0, 7)) and SQL Views (RECTYPE IN (1, 5, 6)) are included in the output. Derived/Work records (RECTYPE = 2) and unexpanded Subrecords (RECTYPE = 3) are excluded.

Component Pages

• Update + Read: Granted when all of the following hold:
  • The menu authorization is not display-only (PSAUTHITEM.DISPLAYONLY = 0)
  • The component does not disable saving (PSPNLGRPDEFN.DISABLESAVE = 0)
  • The underlying record is a SQL Table or Temporary Table (RECTYPE IN (0, 7))
  • The record has at least one editable page field (FIELDUSE & 1 = 0, excluding display-only, related display FIELDUSE & 16 != 0, static text, and visual lines) on that page or its nested subpages
• Read-Only: Granted when DISPLAYONLY = 1, DISABLESAVE = 1, the record is a SQL View (RECTYPE IN (1, 5, 6)), or all fields for that record on the page are display-only.

Component Interfaces

• Update + Read: Granted when PSAUTHBUSCOMP authorizes Save or Create (AUTHORIZEDACTIONS > 0), the underlying record is a SQL Table (RECTYPE IN (0, 7)), and PSBCITEM exposes at least one Read/Write collection or property (BCACCESS = 1, BCTYPE IN (3, 4)).
• Read-Only: Granted when the Component Interface only has read methods (Get/Find), the record is a View, or all exposed items for the record are read-only (BCACCESS = 2). Search key items (BCTYPE IN (1, 2, 5)) are excluded.

Query Access Trees

• Read-Only: All leaf records resolved from PSTREENODE via SCRTY_ACC_GRP are classified as Read-Only.

Limitations & Scope

Because this report evaluates declarative PeopleTools metadata rather than executing runtime code, keep the following scope rules in mind:

• PeopleCode & Batch SQL: Direct database reads or writes executed inside PeopleCode (SQLExec, Record.Insert/Update/Save, Application Package classes) or batch processes (PSAUTHPRCS / Application Engine) are not traced by this report.
• Component Search & Related-Display Records: Component search records (PSPNLGRPDEFN.SEARCHRECNAME / PSMENUITEM.SEARCHRECNAME) and related-display fields (FIELDUSE & 16 != 0) are excluded so the report focuses on component buffer data tables rather than lookup/prompt tables.
• Runtime Field Properties: Page fields that are marked editable in PSPNLFIELD (including invisible page fields) are counted as editable even if component PeopleCode dynamically hides or disables them at runtime (Field.DisplayOnly = True).

Tables Queried

How to Run

• From a Permission List Detail Page: Open any permission list and click Run Table Access Report in the right-hand Reports card.
• From the Run Report Page: Navigate to Reports > Security Reports, enter the Permission List name (CLASSID) in the Permission List Table Access card, and click Run Now.