DFD diagram and ER crossmatrix for role definitions and role's privileges on objects

Question

Hello,
Having the question on derivative use of combination of DFDs and ER diagrams ( let us be more fixes and focus on Relational model ).
In DFD there are defined external entities and functions, data flows and data stores that are forming processes.
Functions represents procedures, transactions, transformations.
Dataflows presents procedures parameters, intermediate reports, temporary table data, data that is passed , retrieved/written, signals, triggers/events that controle or trigger function...
Context of my question is focused on external entities.
External entity suppose to denote the sourced or destinationed system ( for example Archiving system ) or operator, system that is out of scope of the DFD and it is mentioned just as target or destination or source of dataflow or control flow.
In context of these understandings I am using external entitiy also for types of users of the system:  staff that is triggering functions or schedulers or job managers, or reporting systems ( or components of reporting systems like for example business intelligence extraction processes ).
What is my problem that on basis of external entity definitions and E/R model also define roles and privilege classes for access to data objects.
And from those generating ddls for database roles, privileges on entitities to those roles.
But in privileges granting to role having two different kind of privileges on data objects:
- privileges that are granted on various schema objects
   For example role1 has grant on tab1, view2, procedure1, package3,
- the other type of privilega is based on the scope or range of semantically defined scope or semantic area.
Semantic area is scattered through tables because of normalisation and using semantic area as entity of which primary key is
partitioning the table data through many semantic areas.
So this privilege should be granted on basis of the rows in table not column ( more semantically then structurally ...row oriented more than column ).
Both privileges that are granted to roles are also basis for functional roles
( privilege that is granted that functional role has grant to trigger or execute some function or process ).
My question is?
How do you handle modeling technology for analysis and design for role privileges and consolidation between database and functional roles ?
Grateful for any idea, experience and suggestions.

Answer 1

Hello,
Guess I was looking for the formal sequence of steps that would bring me to the
ddls for "create role ..." and "grant privileges to role".
You can do that.
1) I assume you have logical model and it's engineered to relational model, also you have data flow diagram created
2) You need to define information structures for flows connecting "Information store" to primitive process - attribute usage of particular entities should be defined for those "information structures" processed in flows
3) You need to define create, update and delete operation for flow going from primitive process to store - read is assumed in opposite direction
4) create a role in Process model and assign primitive processes to it - list of available processes to add depends on current data flow diagram
5) You need an open physical model for your relational model
6) Select "transfer process model roles to physical model roles" from context menu of top level DFD - select roles, relational and physical model there - roles with related permissions will be created in physical model
Entity1 is divided in several subtypes for different business areas.
And account manager for business_area1 is allowed to work on subtype1 ( view on prime table )...
Different implementation of entity hierarchies are not processed correctly in that wizard - i.e to get permissions to table corresponding to child entity - that entity should be used in information structure and flow.
Philip