'R-What?' Development of a role-based access control policy-writing tool for e-Scientists

An access control policy writing tool for the PERMIS role-based privileges management infrastructure was iteratively developed employing usability principles and techniques. Expert and intermediate users’ efficiency in policy creation was improved. Three novice users took part in a usability trial with the first prototype, attempting to recreate a simple policy in 15 minutes that had been specified in plain English. The participants had not properly understood the labelling of buttons or fields in the interface, and so experienced difficulty in breaking down the policy into components and identifying parts of the application to put them in. The non-specialists found it challenging to express access policy effectively because their concept of it did not match what was presented to them on screen. Bubble help and alert boxes were expanded and made more prescriptive to guide their actions without impacting expert users’ efficiency. Conceptual design techniques were used to revise the labels based on potential users’ descriptions of RBAC. A questionnaire study showed improved label intuitiveness (t=6.28, df=7, p=.000 two tailed): e-Scientists and developers were better able to describe access policy components from labels, and match labels with components. This project has successfully developed an access control tool to improve security specialists’ productivity and improve the wider e-Science community’s access to a flexible security infrastructure.