Overview
Aliquot is transitioning from the legacy Security Template system to a new Group Policy framework. This change improves flexibility, scalability, and administrative control over user permissions.
Under the new system, Security Templates will be migrated into Group Policies, allowing users and roles to be assigned multiple policies while maintaining strict permission integrity.
Key Changes
Migration from Security Templates
All existing Security Templates will be converted into equivalent Group Policies during the update process.
Each template will map directly to a new Group Policy.
Existing user assignments will be preserved where possible.
Administrators may review and modify policies after the update.
Multiple Policy Assignments
Users can now be assigned multiple Group Policies simultaneously.
This allows administrators to:
Combine policies to represent complex roles
Reuse common permission sets across departments
Reduce the need for large monolithic templates
Policy Conflict Prevention
Aliquot enforces strict conflict validation between assigned policies.
A conflict occurs when two policies assign incompatible permissions for the same resource or action.
Examples may include:
One policy granting access while another denies it
Two policies assigning mutually exclusive permissions
Conflict Handling
When a conflicting policy is assigned:
The system will detect the conflict immediately.
The assignment will not be applied.
The user will receive an error message indicating that a policy conflict exists.
The conflicting policy must be removed or adjusted before the assignment can proceed.
Administrative Best Practices
To avoid policy conflicts:
Design policies around specific responsibilities rather than broad access levels.
Avoid overlapping policies that manage the same permission scopes.
Test new policies before assigning them to large user groups.
Benefits of the New System
The new Group Policy framework provides:
Greater flexibility in permission management
Reusable permission sets
Improved security validation
Reduced administrative overhead
Policy Resolution Overview
Aliquot allows users to have multiple Group Policies assigned simultaneously. When policies are assigned, the system evaluates all permissions to ensure no conflicts exist.
If a conflict is detected, the policy assignment is rejected and an error message is returned.
Policy Assignment Workflow
This diagram shows what happens when a policy is assigned to a user.
Explanation
An administrator assigns a policy.
Aliquot retrieves the user's existing policies.
Permissions are evaluated collectively.
If no conflicts exist, the policy is applied.
If a conflict exists, the assignment fails and an error is shown.
Policy Conflict Detection
This diagram shows how Aliquot evaluates permissions across policies.
Example Policy Conflict
Example scenario showing conflicting permissions.
In this example:
Lab Technician allows editing sample report data
Read-Only Auditor denies editing sample report data
Aliquot detects the conflict and rejects the policy assignment
Permission Resolution Model
Aliquot does not override conflicting permissions. Instead, it requires administrators to resolve them manually.