• Due to an organizational Segregation of Duty (SoD) requirement, the Role Owner cannot be allowed to update roles.
• Need to override what is defined in the SecurityContext.csv Aveksa privilege file.
• Uploading the following through the UI (Admin > User Interface > Files > Security Files), does not work as expected.
• Trying to override any existing Aveksa application privileges results in duplicate entries in the underlying database table giving inconsistent privileges when the user logs in.

SECURE_OBJECT_TYPE,NAME,ACTION,IMPLICIT_HAS_QUERY,IMPLICIT_BS_CHANGE,IMPLICIT_BU_CHANGE,SCOPE_TABLE,SCOPE_FILTER
Role,Owner,View,scope,,,t_av_roles,owner_id=${id}

Never upload a full SecurityContext.csv or one changing any existing entitlement(s) through the UI.

1. Create a new unique role custom user attribute using a name other than owner to avoid confusion.  In this example we will use Monitor and add it from the UI b navigating to Admin > Attributes > Role > Edit. Note the name of the custom user attribute selected. In this example it is CAU1.
2. Modify the roles through a collector or manually in the UI to remove the original owner assignment and to propagate the new Role Monitor attribute.
3. Create a new SecurityContext.csv file with only the header and following entry (and any other new attributes needed for other purposes):

SECURE_OBJECT_TYPE,NAME,ACTION,IMPLICIT_HAS_QUERY,IMPLICIT_BS_CHANGE,IMPLICIT_BU_CHANGE,SCOPE_TABLE,SCOPE_FILTER
Role,Monitor,View,scope,,,t_av_roles,CAU1=${id}

4. Upload this new SecurityContext.csv file through the UI (Admin > User Interface > Files > Security Files).
5. Next time the user designated in the Role Monitor attribute logs in, they will have access to view their Roles but will not be able to edit the members or entitlements.
6. Modify workflows if you need the new Role Monitor to do any change request approvals.