Enhancement Proposal – Dynamic Security Handling for Preloaded Database in Maximo Mobile

Background:
Maximo Mobile leverages a preloaded database generated using a template user to improve application performance and offline capabilities. This preloaded database captures data based on the access privileges and security configuration assigned to the template user at the time of generation.

Problem Statement:
In current implementations, when dynamic data restrictions (e.g., conditional expressions, data restrictions based on user attributes, or runtime filters) are applied within Security Groups in Maximo Manage, these restrictions are not respected as expected in the preloaded database.

This occurs because:

• The preloaded database is generated using a single template user.
• Data restrictions defined at the Security Group level are applied uniformly during preload.
• Dynamic or user-specific restrictions (e.g., based on PERSONID, site, or conditional expressions) are not re-evaluated per end user in the mobile application.
• As a result, all users inheriting the same security group may see data that should have been restricted dynamically.

Impact:

• Potential data overexposure in mobile environments.
• Inconsistent behavior between Maximo Manage (server) and Maximo Mobile (offline).
• Limitations in implementing fine-grained, user-specific security controls.
• Increased need for workarounds (multiple template users, separate apps, or custom filtering logic).

Proposed Enhancement:

1. User-Aware Preload Filtering
   • Enable the preloaded database to support user-context-aware filtering.
   • Apply data restrictions dynamically at runtime based on the logged-in mobile user rather than the template user.
2. Separation of Static vs Dynamic Restrictions
   • During preload:
     • Apply only static (non-conditional) security filters.
   • At runtime:
     • Evaluate dynamic restrictions (e.g., based on user attributes, conditions, or expressions).
3. Support for Multiple Template Profiles
   • Allow defining multiple template users or profiles mapped to different roles or data scopes.
   • Mobile app selects appropriate dataset based on logged-in user context.
4. Post-Login Data Refinement Layer
   • Introduce a filtering layer in Maximo Mobile that re-applies security restrictions after user authentication.
   • This ensures compliance with Maximo Manage security rules.
5. Configurable Preload Strategy
   • Provide administrators options such as:
     • “Strict Security Mode” – enforce runtime filtering
     • “Performance Mode” – preload broader data with limited filtering
     • “Hybrid Mode” – balanced approach

Benefits:

• Ensures consistency between Maximo Manage and Mobile security behavior.
• Prevents unintended data exposure.
• Supports enterprise-grade security requirements.
• Reduces need for custom development and workarounds.
• Improves flexibility for complex implementations.

Conclusion:
Enhancing the preloaded database mechanism to better support dynamic security restrictions will significantly improve data security, usability, and alignment with Maximo’s core security model. This is especially critical for organizations with complex, role-based, and condition-driven access requirements.