Currently Admin Console gives the perception that granting permissions by product profile is a scalable way to grant permissions, with AND logic, and reinforced here: Enterprise Help | Manage product permissions in the Admin Console. After talking with Adobe client care, this is false. Not only can product profile permissions conflict with each other, in an OR logic fashion, but there is no way to know how product profiles will interact with each other except through trial and error (per Adobe Client Care Incident: 190204-000614). For example, in trying to combine a product profile with a single report suite in it with a product profile granting access to an array of data feeds utilities, the user does not get access to the single report suite such that it can be used in combination with the data feeds permissions. This was confirmed by ACC.
Solution proposed:
- Create product wide AND or OR logic for product permissions and document it, ideally AND logic
