## Export Control in ION

Export control adds a group-based access decision on top of ION’s standard roles and permissions. A person needs an allowed identity-provider group to reach export-controlled parts, procedures, and runs. Their normal ION permissions still determine which actions they can perform on the records they can reach.

### 1. Configure in Your Identity Provider

#### Access Levels

| Access Type          | Description                                                                                |
|----------------------|--------------------------------------------------------------------------------------------|
| **Export UnRestricted** | Every record, including controlled parts, procedures, and runs.                           |
| **Export-restricted**   | Controlled records are hidden from lists; a direct link returns not found.               |

### 2. How ION Decides Access

During sign-in, ION reads the group memberships your identity provider sends. For each request, ION checks for an exact match with:
- `Employee Export UnRestricted`
- `Export UnRestricted`

If present, the person is export-unrestricted for that session. If missing, they are export-restricted by default.

### 3. What Export Control Protects

Export control applies to three record types. The effect on an export-restricted person is the same for each: the record is filtered out.

| Flagged Record  | Access Effect for Export-Restricted Person                                   |
|------------------|-------------------------------------------------------------------------|
| Part             | Omitted from query results; a direct link returns not found.          |
| Procedure        | Omitted from query results; a direct link returns not found.          |
| Run              | Omitted from query results; a direct link returns not found.          |

### 4. Configure Export-Control Access

1. Contact [First Resonance Support](https://support.firstresonance.io/) to enable export control and confirm that your SSO connection sends identity-provider group membership to ION.
2. In your identity provider, create or identify a group named exactly `Employee Export UnRestricted` or `Export UnRestricted`.
3. Add individuals who can access export-controlled records to these groups. Keep everyone else out.
4. Have the affected person start a new sign-in session after changing group membership.

### 5. Mark a Record as Export-Controlled

An export-unrestricted person sets the flag on the record itself:
- On a procedure, turn on the **Export control** toggle.
- While creating a run, turn on **Export controlled**.
- On a part, set the `export_controlled` column to `true` when importing parts.

### 6. Verify the Restriction

1. Prepare a controlled test record:
   - On a test procedure, turn on **Export control**, then create a run from that procedure.
   - Import a test part with `export_controlled` set to `true` and associate it with a run.
   - Create a run while enabling **Export controlled**.
2. Sign in with an account in an allowed group to confirm access to controlled records.
3. Log in with an account outside both allowed groups to verify controlled records are omitted from query results.
4. Confirm visibility of inventory records while blocking updates to them.

### Related Documentation
- [Set up SSO](https://docs.firstresonance.io/administration/authentication-settings/sso/set-up-sso)
- [Import parts](https://docs.firstresonance.io/administration/ion-importers/parts)  
- [Import runs](https://docs.firstresonance.io/administration/ion-importers/runs)