Access Control Requirements, General Behavior

This section describes the general behavior of the access control system, regardless of whether access control is enabled, or not.

1. For external users, enabling of "access control" is optional
2. The access control system can be enabled or disabled at any time, including:
   1. Initial application installation
   2. Later application use
3. Access control applies to all users
   1. If enabled, all users will be limited by their group assignments
   2. If disabled, all users have free access to system resources
4. Initial user accounts
   1. ACME will ship with two initial user accounts:
      1. Administrator
      2. Unknown User
   2. These two initial user accounts cannot be deleted
5. Administrator account
   1. The Administrator user is in a group also named Administrator
   2. Regardless of whether security is enabled, there will always be an administrative user
   3. The administrator of external security will have the username "Administrator"
   4. The password for this account is initially "admin"
   5. A password for this account is mandatory
   6. The password for this account can be changed only by the Administrator
   7. The Administrator user account cannot be deleted or edited
   8. The Administrator group cannot be deleted or edited
6. Unknown User account
   1. The Unknown User user is in a group named Unknown User
   2. The Unknown User user cannot be deleted or edited
   3. The Unknown Group group cannot be deleted or edited
   4. The Unknown Group group has full access to all functional areas other than User and Group management
   5. Users cannot log in as the user Unknown User when security is enabled
7. CRUDing User Accounts
   1. The Administrator is the only user that can add, delete, and edit user account information
   2. All users can view usernames, group names, group members, and group rights without restriction.
8. The Administrator can log in and use ACME, and has no security restrictions whatsoever.