You can use data locking to ensure that the right people have write access at the right time:
- Lock data entry to any combination of driving dimensions and specific dimension elements.
- Changes in the lock status automatically propagate up or down the hierarchy (that is, locking a parent locks all descendants; locking all children automatically locks the parent).
- Open and Locked states are complemented with a Restricted entry state, which limits entry only to the node owner or the owner of an ascendant node.
There are several options to consider when modeling a solution to control data access:
- Data access profiles in security offer a static solution.
- Data locking is a more dynamic/flexible solution.
- Cell locking is story-specific.
- Access to stories and models depends on which folder they are in as well as whether they are shared.
Data locking lets you set up locks on specific data intersections of a model, which prevents the data changes via data entry and by other planning operations (such as allocations) in stories.
Data locking must be enabled in the model preferences, and you must have the proper permissions to configure data locking.
In a story, locked and restricted cells for public versions appear as read-only. Optionally, you can also delegate ownership of the data locks to members of a dimension. Data locking owners can change the state of the locks that they own.
Implement Data Locking for a Model
1. Enable Data Locking:
Go to Model Preferences of the planning model and click Access and Privacy. Activate Data Locking and set the Default Lock State. The default lock state can be either Open or Locked.
2. Maintain the Organization Type Dimension:
- A hierarchy is needed so that statuses of parents can be inherited by children for example.
- The owner property requires either teams or users, or both.
- The person responsible property can be used to determine the owners.
- Data Locking Owner: This property is created in the organization dimension when data locking is enabled.
- Reviewer: This is not used in data locking (it can be used in an calendar Process).
- Hierarchy: Children inherit the locks of parents.
- Person Responsible: Users here can be inherited from the owner property.
3. Define Driving Dimensions:
Version and Date are mandatory driving dimensions. The driving dimensions further define the specific intersection of data that will be locked.
For example, if you want to lock data for a specific member of an Organization dimension, you would need to include the Organization dimension as a driving dimension.
4. Select Data Region:
Select the data region for the lock. For example, 2025, Southeast, Forecast version.
5. Set Locks:
Select Show Grid to display a grid of the driving dimensions where you can set the lock state of each intersection:
- Open: Values are unlocked for this combination of members in table, and can be changed by any users who have permissions to enter values for the model.
- Restricted: Values can be changed only by a user who has effective ownership of locks on this combination of members. Select the restricted cell and select Add Owner under a driving dimension and choose one or more owners for the selected member of that driving dimension.
- Locked: Values cannot be changed for this combination of members in a table.
When you change the state for a parent member in a dimension, the same state is applied to its children as well. For example, if you lock North America, then the United States and Canada will also be locked.
Configure the Data Lock Dimensions
In the example below, you select the Configure the Data Lock icon to start. Then, after choosing Entity as a new driving dimension, the Enable Ownership option is selected. This will prompt the system to look up owners from the entity dimension. In this example, the Organization Type dimension is Entity, however, it depends on the dimensionality of the model as to which dimension is the organization type. For example, in cost center planning, the Cost Center dimension would be the Organization Type dimension.
- Data Locking Owner: Can contain one or more teams and users.
- Person Responsible: Can contain only one user.
- Review: A custom property and can contain only one user.