Configure export control - ION Manual

Export Control in ION

Export control adds a group-based access decision on top of ION’s standard roles and permissions. A person needs an allowed identity-provider group to reach export-controlled parts, procedures, and runs. Their normal ION permissions still determine which actions they can perform on the records they can reach.

1. Configure in Your Identity Provider

Access Levels

Access Type	Description
Export UnRestricted	Every record, including controlled parts, procedures, and runs.
Export-restricted	Controlled records are hidden from lists; a direct link returns not found.

2. How ION Decides Access

During sign-in, ION reads the group memberships your identity provider sends. For each request, ION checks for an exact match with:

Employee Export UnRestricted
Export UnRestricted

If present, the person is export-unrestricted for that session. If missing, they are export-restricted by default.

3. What Export Control Protects

Export control applies to three record types. The effect on an export-restricted person is the same for each: the record is filtered out.

Flagged Record	Access Effect for Export-Restricted Person
Part	Omitted from query results; a direct link returns not found.
Procedure	Omitted from query results; a direct link returns not found.
Run	Omitted from query results; a direct link returns not found.

4. Configure Export-Control Access

Contact First Resonance Support to enable export control and confirm that your SSO connection sends identity-provider group membership to ION.
In your identity provider, create or identify a group named exactly Employee Export UnRestricted or Export UnRestricted.
Add individuals who can access export-controlled records to these groups. Keep everyone else out.
Have the affected person start a new sign-in session after changing group membership.

5. Mark a Record as Export-Controlled

An export-unrestricted person sets the flag on the record itself:

On a procedure, turn on the Export control toggle.
While creating a run, turn on Export controlled.
On a part, set the export_controlled column to true when importing parts.

6. Verify the Restriction

Prepare a controlled test record:
- On a test procedure, turn on Export control, then create a run from that procedure.
- Import a test part with export_controlled set to true and associate it with a run.
- Create a run while enabling Export controlled.
Sign in with an account in an allowed group to confirm access to controlled records.
Log in with an account outside both allowed groups to verify controlled records are omitted from query results.
Confirm visibility of inventory records while blocking updates to them.