RE: Athuorization lists

> From: rob@xxxxxxxxx
> 
> (Some Luddites won't.
>  Their's are the systems that are replaced with wintel servers because the
> users can then get to the data, when it wasn't the technologies fault at
> all.)

Now now.  I resemble that remark <grin>.  Personally, I have two points that
need to be considered from a business standpoint:

1. Don't allow external updates to your files, except for specific batch
input files designed for the task.  (In the ante-diluvean days these had
names like "batch input" or "suspense" files -- or EDI files).

2. Understand that having users directly access data means that changes to
your database wreak havoc throughout your organization.  Not only that, but
they need to understand the intricacies of how your data is stored.

Allowing access through shadow files, stored procedures and message-based
servers allows you to make database changes without affecting your users,
including the ability to have combinations of online, offline and nearline
storage without their knowledge.  But there is a cost: you have to keep the
interfaces up to date, and some people don't have the time to do that.

This whole concept, though, brings up an interesting point.  Exactly how
much unfettered access should the users have to the data in the database?
There is a rather interesting notion that "the data belongs to the user",
but that's only true in so far as "the medication belongs to the patient".
Medicine should be prescribed by physicians, data should be provided by
programmers.  Yes, the users own the data in the fact that whatever they key
in ought to be accessible to them, but to say that the users needs to know
the key to the price file, or be able to modify the amount on a general
ledger transaction, doesn't make sense to me.


> We used an exit point to only allow them to download a particular
> temp file.  Took them only about an hour to discover that they could copy
> over this file with any data they wanted from a query and still download
> it.

Do you have mapped drives?  If so, they can do a CPYTOSTMF and also get data
quite easily.  Or with QNTC they can push the data right out to a file
server.

Joe