Groups Reference Page

Introduction

Appian's GAM Acquisition Central comes with a number of groups provided by default. By adding users to these groups, you can grant access to separate parts of the solution.

There are three categories that the default groups belong to:

• Business Groups:
  • These groups represent the different business roles that will interact with the solution.
    • Example Groups: Contract Officer, Contract Specialist and Contracting Manager.
• Security Groups:
  • These groups are set as the security for certain Appian objects. Different business groups are members of security groups to grant access to solution functionality to entire roles.
    • Example Groups: AS GSM Administrators, AS GAM Appian Administrators, and Government Acquisition Management.
• Wrapper Groups:
  • These groups are used to group together a number of groups of the same category. For instance, a list of business groups may be added to a certain wrapper group. This allows for querying for all groups of a certain category in different parts of the application.
  • Examples Groups: AS GCW Business Roles and AS GCW Departments.

This page lists the default groups provided when you install the GAM Acquisition Central, what business groups belong to which wrapper and security groups, and what actions members of the security groups can perform.

User Access Management and groups

With the introduction of User Access Management (UAM) in GAM Acquisition Central 1.4, the relationship between roles and Appian Groups has evolved. UAM provides business administrators with the ability to create and manage roles directly within the application, which automatically generates the corresponding Appian Groups.

UAM-managed groups

When you create a role in UAM, the system automatically:

1. Generates an Appian Group with a name that corresponds to the role.
2. Applies the appropriate permissions based on the role's assigned permission sets and permissions.
3. Maintains synchronization between the UAM role and the Appian Group.

These UAM-managed groups function like traditional Appian Groups but are created and maintained through the UAM interface rather than the Appian Admin Console. This allows business administrators to manage security without requiring system administrator access.

Traditional vs. UAM-managed groups

GAM Acquisition Central now supports two types of groups:

• Traditional Groups: Pre-configured groups installed with the solution (listed in the tables below). These groups are managed through the Appian Admin Console by system administrators.
• UAM-Managed Groups: Dynamically created groups that correspond to roles defined in the UAM site. These groups are managed by UAM Administrators through the UAM interface.

Both types of groups can coexist and work together within the GAM Acquisition Central solution.

Group visibility

In order for the correct groups to show up in application pickers, each type of group has the following visibility settings:

Group Type	Visibility	Reason
Business group	Public	End users should be able to select business groups in application pickers.
Security group	Private	End users should never see security groups in application pickers.
Wrapper group	Private	End users should never see wrapper groups in application pickers.
UAM-managed group	Varies	Visibility is determined by the role configuration in UAM. Business administrators set visibility when creating roles.

UAM Administrator groups

The following groups control access to User Access Management features:

Group Name	Purpose	Access Level
AS GSM UAM Administrators	Grants full access to the User Access Management site, including the ability to create and manage roles, permission sets, and user records.	Full UAM administrative access
AS GSM UAM Viewers	Grants read-only access to UAM to view roles, permission sets, and user records without the ability to make changes.	Read-only UAM access
AS GSM UAM Sync Process	System group used by automated synchronization processes to pull users and groups from the Appian platform into UAM.	System process access

Required Documents group

The following groups control access to the Required Documents feature introduced in GAM Acquisition Central 1.6:

Group Name	Purpose	Access Level
AS GSM Required Document Page Access	Grants access to view, create, and update document profiles on the Required Documents page.	Full Required Documents administrative access
AS GSM Activate & Deactivate Document Profiles	Grants the ability to activate and deactivate document profiles. Members can change the active status of document profiles without full create/update permissions.	Document profile lifecycle management

Wrapper group membership

This table lists all of the default business groups and the wrapper group that they belong to.

Department head groups are also members of the associated GAM Acquisition Central Internal Users groups.

The business groups are all members of the AS GSM Personnel group type.

How UAM-managed groups integrate with existing security

UAM-managed groups work seamlessly with the existing GAM Acquisition Central security model:

1. Automatic Group Creation: When a UAM Administrator creates a role, the corresponding Appian Group is automatically generated with the appropriate naming convention (e.g., "UAM - [Role Name]").

2. Permission Inheritance: UAM-managed groups can be granted the same security permissions as traditional groups. For example, a UAM-managed "Senior Contract Officer" role can be added to the "AS GSM Create Vendor PM Access" security group.

3. Role Hierarchy: When roles have parent-child relationships in UAM, the corresponding groups maintain those relationships, ensuring users inherit permissions appropriately.

4. Synchronization: The nightly sync process ensures that UAM-managed groups stay current with any changes made in the Appian platform, maintaining consistency across the system.

5. Audit Trail: All changes to UAM-managed groups are tracked in the UAM audit trail, providing visibility into who modified group membership and when.

Best practices for UAM-managed groups

• Naming Convention: UAM automatically prefixes managed groups with "UAM -" to distinguish them from traditional groups.
• Group Membership: Add users to roles through the UAM interface rather than directly modifying group membership in the Appian Admin Console.
• Security Group Assignment: UAM Administrators can assign UAM-managed groups to existing security groups to grant access to specific features.
• Migration Strategy: Organizations can gradually migrate from traditional groups to UAM-managed groups, allowing both to coexist during the transition.

Actions with Security Group	Security Group	Business Groups with Access
Manage Appian design objects for a GAM solution	AS GSM Administrators	NA
Manage Appian design objects for all GAM solutions	AS GAM Appian Administrators
Receive automatic process model alerts	AS GSM Designer Alerts Group
Activate a vendor	AS GSM Activate Vendor PM Access	Contracting Officer Contract Specialist Contracting Manager Contracting Officer's Representative
Delete a vendor group	AS GSM Delete Vendor Group PM Access
Create or update a vendor group	AS GSM Create Vendor Groups PM Access
View a vendor summary	AS GSM View Sections PM Access
Create or update a vendor	AS GSM Create Vendor PM Access
Deactivate a vendor	AS GSM Deactivate Vendor PM Access
Sync a vendor from SAM.gov	AS GSM Get Vendor From SAM.Gov PM Access
View the GAM Acquisition Central site	AS GSM GAM Acquisition Central Site Access
View, create, and update required document profiles	AS GSM Required Document Page Access
Activate and deactivate document profiles	AS GSM Activate & Deactivate Document Profiles

Feedback