User Access Management Overview

What is User Access Management in GAM Acquisition Central?

Managing user access and security in federal procurement systems has traditionally required technical expertise and system administrator involvement. Business administrators often depend on IT resources to provision new users, update permissions when employees change roles, and maintain compliance with security policies. This dependency creates bottlenecks, delays user onboarding, and increases the risk of outdated or incorrect access configurations.

What if business administrators could manage user permissions, roles, and security directly—without relying on technical tools or system administrators?

User Access Management (UAM) in GAM Acquisition Central provides a business-friendly interface for managing access control across the solution. Built on the Appian platform, UAM empowers non-technical users to handle security management tasks that previously required system administrator intervention.

Key capabilities

Access model

UAM implements a three-tier access model:

Users → Roles → Permission Sets → Permissions

• Users are assigned to Roles.
• Roles contain Permission Sets.
• Permission Sets contain Permissions, which are granular security groups backed by Appian Groups.

Roles are backed by Appian Groups. Permission sets are NOT backed by Appian Groups—they serve as logical groupings within UAM. Permissions are backed by Appian Groups and control actual platform-level access.

Role management

UAM enables business administrators to create and update roles directly within the application. Each role automatically generates a corresponding Appian Group, eliminating the need for manual group creation in the Appian Admin Console. Roles define the set of permissions a user receives when assigned to that role, providing a structured approach to access control.

Roles support parent-child hierarchies through child role assignments. When child roles are added to a parent role, the parent automatically inherits all permission sets from its children. These inherited permission sets are tagged "From Child" in the role configuration and are managed through the child role relationship.

Permission sets

Permission sets allow administrators to group granular permissions into reusable collections organized under a business function label. Instead of assigning individual permissions to each role, administrators can create permission sets like "Manage Contracts" or "Approve Vendor" and assign them to multiple roles. Permission sets are not backed by Appian Groups—they exist as logical groupings within UAM to simplify permission management and ensure consistency across the organization.

User record management

UAM provides a centralized location for managing user records with business-critical metadata. Administrators can track information such as Warrant Levels, which determine a user's contract approval authority, alongside standard user details. UAM user records serve as the single source of truth for user-related business data within the GAM Acquisition Central solution.

User records include the following fields:

• Required fields:
  • Name.
  • Status (defaults to Active).
  • Username (validated for uniqueness).
  • Email.
• Optional fields:
  • Location.
  • Title.
  • Phone.
  • Warrant Issue Date.
  • Warrant Expiration Date.
  • Proxy (user lookup).
  • Manager (user lookup).
  • Direct Reports (user lookup, multiselect).

Role hierarchy and inheritance

Roles can be organized into parent-child hierarchies that mirror organizational structures. When creating or updating a role, administrators can assign child roles in the Overview tab. The parent role automatically inherits all permission sets from its child roles. These inherited permission sets appear with a "From Child" tag in the role's Permission Sets tab, providing clear visibility into which access is directly assigned versus inherited. This reduces the complexity of managing permissions for users with multiple responsibilities and ensures that role changes propagate correctly throughout the hierarchy.

Automated synchronization

UAM includes an automated process to maintain synchronization between the Appian platform and the UAM system. Each nightly sync pulls new users, updates existing user metadata, and pulls new groups, maintaining data consistency across the system. New roles should be created in UAM. This synchronization will ensure any newly created permission is available to use in UAM.

Comprehensive audit trail

Every access change in UAM is tracked with a complete audit trail that captures who made the change, what was modified, and when it occurred. This transparency supports compliance with security policies, regulatory requirements, and internal security reviews.

Who uses UAM?

UAM is designed for the following user types:

• UAM Administrators: Business administrators responsible for managing roles, permission sets, and user access. They have full access to create, update, and delete UAM configurations.
• UAM Viewers: Users with read-only access to view roles, permission sets, and user records for reporting and oversight purposes.

See the Groups Reference Page for more information about UAM-related groups and permissions.

How UAM integrates with GAM Acquisition Central

UAM works alongside the existing GAM Acquisition Central security model. Traditional groups installed with the solution continue to function as before, while UAM-managed groups provide an additional layer of business-driven access control. Both types of groups can coexist, allowing organizations to gradually adopt UAM at their own pace.

For details on how UAM-managed groups integrate with existing security groups, see the Groups Reference Page.

Get started with User Access Management

Ready to set up User Access Management for your organization? See Setting Up User Access Management to configure administrator access, run synchronization processes, and build your role structure.

Feedback