A security policy is a named, reusable set of permission statements. You write the grants once, then attach the policy wherever those permissions are needed.
A security role is a named set of permissions that you attach to a console user. A role can include Rhythm’s ready-made policies, your organization’s policies, and permission statements written directly on the role. To learn what a permission statement can do, see Permission Statements.
Where to Find Them
- Security policies: System & Security › Security › Policies. The list shows each policy’s name, description, and active status.
- Security roles: System & Security › Security › Roles. The list shows each role’s name and description. Roles do not have an active or inactive status.
Select Create Security Policy or Create Security Role to add a new policy or role. You can also clone, edit, or delete an existing one from its row.
If your organization has not turned on this level of security, both menu options open a page with this message: "Custom security roles & policies are not available under the standard roles & permissions license. Contact your Customer Success Manager to upgrade to advanced granular security in order to enable this functionality." If you open either page from a saved link or your browser history instead of the left-hand menu, nothing happens and you will not see that message. Use the left-hand menu when you need to confirm whether the feature is available.
The Settings
Security Policy Settings
| Setting | Options | Default | Effect |
|---|---|---|---|
| Name: | Any text | — | Required. This name appears in the policy list and in the pickers where you attach the policy to a role or console user. |
| ID: | Text, prefixed with your organization's identifier on a new policy | Your organization's identifier plus a generated value | Required. The help text says you cannot change this after you save, so treat it as fixed once the policy is saved. |
| Status: | Active or Inactive | Active | Required. An inactive policy’s effect has not been established when it remains attached to a role or console user. To remove access, do not rely on this switch alone; remove the attachment or remove the policy’s statements. |
| Description | Any text | Blank | Optional notes about what the policy is for. This appears in the policy list. |
| Permissions | Add, edit, or delete inline statements | None | Grants written directly on the policy. See Permission Statements. |
Security Role Settings
| Setting | Options | Default | Effect |
|---|---|---|---|
| Name: | Any text | — | Required. This name appears in the role list and wherever you attach roles to console users. |
| ID: | Text, prefixed with your organization's identifier on a new role | Your organization's identifier plus a generated value | Required. The help text says you cannot change this after you save, so treat it as fixed once the role is saved. |
| Description | Any text | Blank | Optional notes about what the role is for. |
| Managed Policies: | Every ready-made policy Rhythm provides, grouped by application | None selected | Attaches Rhythm-maintained policies to the role. Rhythm publishes a reference that lists every managed policy by application and the permissions each one grants, so check it before you write a custom policy that duplicates a built-in one. |
| Customer Policies: | Your own organization's security policies | None selected | Attaches policies your organization wrote. This option is available because reaching this screen already requires this level of security to be turned on. |
| Permissions | Add, edit, or delete inline statements | None | Grants written directly on the role, in addition to grants from its attached policies. See Permission Statements. |
A security role does not have an Active/Inactive switch, and it cannot include another security role. Only a console user can have roles attached.
Dependencies and Precedence
- Your organization must have this level of security turned on before you can reach any of these four screens. If you do not see Policies or Roles under Security in the left-hand menu, or you see the upgrade message described above, see I Get Access Denied or Cannot Find Security Settings in the Console.
- A console user’s actual access comes from everything attached to that user: roles, the managed and organization policies on those roles, each role’s own permission statements, and any statements attached directly to the user. These screens do not show that combined access, so review each attached role and policy when you need to know exactly what someone can do.
- A policy attached to a role gives access through that role, and a role attached to a console user gives access through that user. Deleting or emptying either one changes access for everyone who had it.
- A custom security role or an individual statement attached directly to a user can broaden what a Rhythm-managed policy on the same user was meant to limit. If someone has more access than the managed policy alone suggests, check whether a custom role or statement on their record grants the difference before you assume the policy itself is wrong. Some administrators have also reported that a Managed Policy did not reliably override a Security Role for a user who held both, so if a person's access does not match the policy you selected, check their attached roles and any inline statements as well.
- Course registration status and credits earned are not currently supported as direct eligibility criteria in a portal security policy.
Change Impact and How to Revert
- Saving a policy or role writes the change right away. There is no separate publish step. It has not been established whether someone who is already signed in gets the change immediately or only the next time they sign in. If access needs to change right away, consider asking that person to sign out and back in.
- Deleting a policy or role is permanent. The confirmation says, "You are deleting [name]. This operation cannot be undone." The screen does not check or warn you whether a role or console user still depends on what you are deleting, or whether a policy is still attached somewhere. Confirm that nobody needs it before you delete it.
- A policy or role that Rhythm has protected from deletion has no edit or delete icon on its row. The row’s tooltip says, "This record is locked and cannot be edited or deleted." Contact Rhythm Support if you believe a protected record needs to change.
- Cancel and navigating away both discard unsaved changes without warning.
Permissions
To reach these four screens, your organization needs the advanced-security setting, and your console user needs Security access. If the advanced-security setting is missing, you will see the upgrade message above. If your console user does not have permission, you will see an Access Denied message. See I Get Access Denied or Cannot Find Security Settings in the Console for what to do about Access Denied, and How the Console Decides What You Can See for how permission checks work across Rhythm.
Validation and Errors
| What you see | Meaning and what to do |
|---|---|
| A Form Errors card listing problems | A required setting, usually Name:, is missing. Fill it in, then save again. |
| "A record already exists with this name." | Despite the wording, Rhythm is checking the ID:, not the name. Another policy or role in your organization already uses that identifier, so choose a different one. |
| "Unable to save Security Policy" / "Unable to save Security Role" | Rhythm refused the save. Your edits remain in the form, so fix the problem and try again. |
| "Unable to delete Security Policy" / "Unable to delete Security Role" | Rhythm refused the delete, and the record remains. |
| "This record is locked and cannot be edited or deleted." | Rhythm has protected this record from changes. |
| "Custom security roles & policies are not available under the standard roles & permissions license. Contact your Customer Success Manager to upgrade to advanced granular security in order to enable this functionality." | Your organization has not turned on this level of security. Contact your Customer Success Manager. |
API Support
If you need to check policy eligibility programmatically, the Rhythm API offers a GET endpoint to check whether a specific contact is eligible for a given security policy, and another endpoint to list every security policy a contact is eligible for.