1. Identification
| Parameter | Value |
|---|---|
| Object Type | Catalog |
| Name | AccessKeys |
| Full Name | Catalogs.AccessKeys / Catalog.AccessKeys |
| Alias | — (not specified) |
| Configuration | Accounting for Kazakhstan, edition 3.0 (version 3.0.74.2) |
| Subsystem | “Standard Subsystems” (BSP) → “Access Management” |
| Purpose | Service technical catalog. Stores keys (hashes) of sets of access restriction values used by the record-level security (RLS) mechanism. Filled and used programmatically by the access management subsystem; manual editing by users is not intended. |
Object Characteristic. This is an internal (service) object of BSP, not an application document or accounting reference. It does not participate in accounting, tax, or regulatory accounting, does not store reference data of the subject area (counterparties, goods, accounts), and is not related to the calculation of taxes and contributions. Its sole purpose is to ensure quick verification of access rights to records of application objects through pre-calculated keys.
Where to find:
- Navigation link:
e1cib/list/Catalog.AccessKeys - In the interface: usually hidden from ordinary users. Available to the administrator through the “Administration” section → “Standard Subsystems” (access management) or directly via the navigation link. There is no direct menu item for ordinary users.
2. Attributes of Header and Table Parts
2.1. Header Attributes
| Name | Type | Mandatory | Purpose |
|---|---|---|---|
| List | CatalogRef.ObjectIdentifiersExtensions, CatalogRef.ObjectIdentifiersMetadata | Not checked | Reference to the metadata object (or extension object) for which the access key is defined. Essentially indicates the “lists/tables” to which the key relates. |
| ForExternalUsers | Boolean | Not checked | Indicator that the key is intended for external users (partners/clients via web access), not for internal employees. Divides the key space into two independent contours. |
| Hash | Number | Not checked | Hash value uniquely identifying the combination of access parameters. Serves for quick search and matching of the key. |
| FieldComposition | Number | Not checked | Numeric (bitwise) representation of the composition of fields involved in defining the key: which specific values from the set Value1…ValueN are filled and used. |
| Value1 | Type not defined (composite, depends on application objects) | Not checked | The first value of the access restriction parameter. |
| Value2 | Type not defined | Not checked | The second value of the access restriction parameter. |
| Value3 | Type not defined | Not checked | The third value of the access restriction parameter. |
| Value4 | Type not defined | Not checked | The fourth value of the access restriction parameter. |
| Value5 | Type not defined | Not checked | The fifth value of the access restriction parameter. |
| NotUsedSince | Date and time | Not checked | Date/time from which the key is no longer used. Marks archival (obsolete) records subject to periodic cleaning by a scheduled task. |
Explanation of fields Value1…Value5. Each field is an element of the access value set. The values are references to objects for which restrictions are applied (for example, elements of access dimension catalogs: organizations, warehouses, groups of counterparties, etc.), as well as predefined service values. The type of fields is intentionally left undefined/composite because the same catalog serves keys for different application objects with different sets of access dimensions. The combination of FieldComposition + Value1…N uniquely describes a specific set of restrictions, and Hash is its summary for quick search.
2.2. Table Parts
Table parts expand the number of stored values beyond the five header attributes — for sets of restrictions with a larger number of dimensions.
Header — additional values of access parameters (6–10):
| Name | Type | Purpose |
|---|---|---|
| Value6 | Type not defined | Sixth value of the access restriction parameter |
| Value7 | Type not defined | Seventh value of the access restriction parameter |
| Value8 | Type not defined | Eighth value of the access restriction parameter |
| Value9 | Type not defined | Ninth value of the access restriction parameter |
| Value10 | Type not defined | Tenth value of the access restriction parameter |
TablePart1 — additional sets of access restriction values (first extended block):
| Name | Type | Purpose |
|---|---|---|
| Value1 | Type not defined | First value in the parameter set |
| Value2 | Type not defined | Second value in the parameter set |
| Value3 | Type not defined | Third value in the parameter set |
| Value4 | Type not defined | Fourth value in the parameter set |
| … | … | Further — continuation of the value set (according to the specific version of BSP) |
The presence of values moved to table parts (6–10 and beyond) allows storing sets of restrictions of arbitrary width without increasing the number of header attributes. The filling of specific fields is determined by the value of the attribute
FieldComposition.
3. Forms
For the service catalog, the set of forms is minimal and oriented towards administration, not everyday user work:
| Form | Purpose |
|---|---|
| List Form (main) | View of the list of access keys by the administrator. Opens via the link e1cib/list/Catalog.AccessKeys. Used for diagnosing the access restriction mechanism. |
| Element Form (main) | View of the values of a specific key: List, Hash, FieldComposition, values Value1…N, indicator ForExternalUsers, NotUsedSince. Has a service-diagnostic nature. |
| Selection Form | Programmatic selection of the key in service mechanisms (if available). |
There are no specialized input forms/helpers for the user; records are created automatically by the access management subsystem.
4. Key Procedures of Modules
No specific application BSL code (evidence with paths and strings) for this object is provided, so below are listed typical handlers characteristic of a service catalog of this type in BSP. The logic of filling and usage is concentrated not in the catalog itself, but in the general modules of the access management subsystem.
Object Module / Manager Module (typical handlers):
BeforeWriting— control of the correctness of filling the key before writing (consistency ofFieldComposition,Hash, and filled values).FillingProcessing— initial filling during programmatic creation of the key.OnCopying— as a rule, manual copying of service keys is not intended.
General modules of the access management subsystem (where the mechanism actually works):
- Modules of type
AccessManagement/ServiceAccessManagement(BSP) — calculate sets of access values for application objects, computeHashandFieldComposition, find existing keys or create a new element of the catalogAccessKeys. - Key update mechanism — upon changing rights, composition of access groups, or profiles, recalculates and updates keys.
- Scheduled cleaning task — marks and deletes unused keys based on the attribute
NotUsedSince.
Requires verification (version-specific): exact names of general modules and scheduled tasks, as well as signatures of procedures depend on the version of BSP included in 3.0.74.2. Please clarify with the configurator of the specific delivery.
5. Posting and Movements
The catalog is not a document and does not perform postings. It does not generate accounting entries and does not create movements in accumulation/accounting registers.
Accordingly, for this object neither the chart of accounts of the RK, nor tax rates, nor calculations for VAT/individual income tax/contributions are applied. Accounting accounts of the RK (1210 “Short-term receivables from customers”, 1030 “Cash in current accounts”, 1330 “Goods”, 3310 “Payables to suppliers”, 3130 “VAT payable”, 6010 “Revenue from sales”, 7010 “Cost of sales”), VAT rate of 16%, individual income tax, pension contributions, social tax, as well as electronic documents ESF/SNT have no relation to this object — this is purely a technical infrastructure for access differentiation.
How it participates in the operation of the system. Elements of the catalog are used in access restriction templates (RLS): when building queries to application data, the system matches available sets of values to access keys of records based on Hash and FieldComposition and filters out inaccessible rows. Interaction occurs with information registers of the access management subsystem (sets of access values, groups of access values, etc.), not with accounting registers.
6. Related Objects and Input Based On
Related Objects:
Catalog.ObjectIdentifiersMetadata— source of the reference in the attributeList; identifies the application object to which the key relates.Catalog.ObjectIdentifiersExtensions— the same for extension objects of the configuration.- Objects of the access management subsystem BSP: profiles of access groups, user access groups, information registers with sets of access values — they form the initial data for calculating keys.
- Access dimension catalogs of the subject area (organizations, warehouses, groups of counterparties, etc.) — their elements enter fields Value1…N as values of restrictions.
Input Based On: not provided — the object is service, not a source or receiver of input based on.
7. Extension Points
- Composition of access dimensions. Extending access rights of application objects (adding/changing RLS dimensions) affects the structure of filled key values. Changes are made through the configuration of access restrictions in BSP, not by editing the catalog.
- Configuration extensions. Through
ObjectIdentifiersExtensions, the mechanism supports keys for objects added by extensions; when developing extensions with their own access restrictions, keys are created automatically. - Cleaning schedule. The behavior of cleaning obsolete keys (by
NotUsedSince) is configured by the parameters of the scheduled task of the access management subsystem. - It is not recommended to modify the structure of the catalog itself (attributes
Hash,FieldComposition, values) — this is an internal contract of BSP; changes may disrupt the operation of RLS and complicate configuration updates. Customization of access is conducted using standard tools of the access management subsystem.
Requires verification (version-specific): the specific list of supported access dimensions and the complete set of registers of the subsystem depend on the version of BSP in the delivery 3.0.74.2.