Cognos Analytics

 View Only

 Hide/disable "Permissions" tab in object properties page

Robert Dostal's profile image
Robert Dostal IBM Champion posted 07/17/26 05:19 AM

I have the following issue and couldn’t find a solution yet:

In our Team content are special folders where some user groups have the right to save their user-defined reports and dashboards into to share them with other users in CA.

As owner of their own reports and dashboards they can access the “Permissions” tab on the object properties page and modify the access rights for other groups as well. Is there a way to hide the “Permissions” tab for certain user groups/roles in CA? I don’t want those users to mess around with access rights on their own objects.

I had no luck so far browsing through the customization of features of roles nor could I find an according capability to deny access to the tab.

What am I missing?

F A's profile image
F A posted 08/06/26 08:20 AM

Hi Robert, 

For those groups you can assign "Set Policy" to Deny.

On you screenshot, you can either do it on the parent directory or on each individual objects. 
For example "Authors" Click the current permission "Write" and it will open up the permissions details and you'll find the "Set Policy" is set on default.
All you need to do is to set it on Deny.

Robert Dostal's profile image
Robert Dostal IBM Champion posted 08/06/26 11:31 AM

Hi F A,

thanks for your reply. It does not help. You have to keep in mind that my concept is about a folder where users are allowed to create new reports and dashboards. As owner of these objects, they're automatically admins for them. Even with their groups set to "DENY" for set permissions, they are still able to change the permissions on all objects they have created. That is the issue here.

And the users don’t tell me when they create new objects so I can change the owner to another (technical) user. I want a built-in solution that works or every new object instantly.

F A's profile image
F A posted 08/06/26 12:32 PM

Hi Robert,

You are right, as owners of the objects they'll automatically have full permissions on those objects. 
This is tricky, i don't think there's a direct way to enforce this.

I asked AI, one answer that i think can help is to create a REST API script.

  • Scans a specific folder every few minutes or nightly.
  • Finds objects whose owner is not your service account.
  • Changes the owner (or copies the object and deletes the original, depending on your governance model).

Related Content