Security model

Categorizing users

In i2 Analyze, all users are members of one or more groups. For example, there might be a group of "administrator" users. There might be separate groups of users for each operational team in your organization. There might be a group of users with higher security clearance than others. Or there might be a group of users who need access to a particular piece of functionality.

System groups

System groups are set up by a system administrator. System groups are used to control all aspects of access to records and features in i2 Analyze, including artifact sharing.

Custom groups

Custom groups can be created and managed by any users whose system group membership permits them to do so. At this version of i2 Analyze, custom groups are used only to enable their members to share artifacts with each other.

Categorizing records

Just as users of i2 Analyze are categorized, so too are records, according to a range of deployment-specific criteria. For example, records might be categorized according to the nature of the information they contain, or how sensitive that information is.

Security schema

To make sure that users see only the records that they are allowed to see, every deployment of i2 Analyze has a security schema. The security schema defines the categories into which records must be placed, and the relationships that determine what access users get to records in a particular category.

In other words, the i2 Analyze security schema allows you to create rules that say things like, "Users with low security clearance cannot see sensitive records," or "Users in Group 1 can only see records whose source was signals intelligence." i2 Analyze then combines the rules predictably, on a per-record and per-user basis.

Important: Orthogonal to this security model, i2 Analyze supports blanket controls over the visibility of records with particular types. You can specify that only users in certain system groups can see records of a specific type, and that all records of that type are invisible to all other users, regardless of security schema categories. For more information about this functionality, see Item type security.