If you are the owner of an object, you can exercise two different roles when working with the object:
Administration: | As the owner of an object, you manage the access rules of the object by setting the protection attributes. You are permitted to do this because you are the owner of the object. |
Access: | You access the data part of an object you own. In doing this, you are subject to all of the access rules you have defined as part of your administrative activities. |
If you use your own guards to protect an object that you own, the following applies:
Administration: | You manage the access rules of an object protected by your own guards by setting the protection attributes. You are permitted to do this as the owner of the guards. |
Access: | You access the data part of an object you own that is protected by your own guards. You are subject to all of the access conditions you have defined for your own guards as part of your administrative activities. |
On the other hand, if you use other guards (guards that do not belong to you) to protect an object you own, the following applies:
Administration: | You cannot manage the access rules of an object you own that is protected by other guards. Your are not permitted to do this because you are not the owner of the guards. |
Access: | You access the data part of an object you own that is protected by guards you do not own. |
In order to do this, you must have permission to use these guards to protect your objects. This permission can only be granted by a guard owner. To do this, the guard owner uses the SCOPE guard attribute. | |
In other words, access to an object protected by a guard is always refused unless permission to use the guard has been granted. It may also be refused if the guard is inaccessible for some other reason. | |
CAUTION! When an object is associated with a guard, no check is carried out to establish whether or not the guard is accessible or may be used. This is not done until the object is actually accessed. |