Producer code security for agents working for multiple agencies

In the base configuration, PolicyCenter assumes that agents are external users working on policies for a single agency. In PolicyCenter, the agency is represented by an organization. External users can be assigned to groups only within their organization. Users inherit producer codes from their groups. In addition, external users can be assigned producer codes from their organization.

However, some agents work on policies for more than one agency (organization). In the base configuration, this agent needs a username for each organization. Through a configuration parameter, PolicyCenter enables you to assign an external user to groups and producer codes from more than one organization. The ExternalUserAccess configuration parameter has three settings. In order of increasing access to groups and producer codes, these settings are:

FULLYRESTRICTED – Default. With Fully Restricted, external users can be assigned to groups only within their organization. Users inherit producer codes from their groups. In addition, external users can be assigned producer codes from their organization.
PROTECTINTERNAL – With Protect Internal, external users can be assigned to any external groups. Users inherit producer codes from their groups. In addition, external users can be assigned producer codes from any external organization.
ALLOWINTERNAL – With Allow Internal, external users can be assigned to any groups, internal or external. Users inherit producer codes from their groups. In addition, external users can be assigned producer codes from internal or external organizations.

As needed, you can change this parameter to increase access to groups and producer codes.

Note: You can only change the value to increase access. The server will not start if you set ExternalUserAccess to a value that decreases access. For example, if you change the value to ALLOWINTERNAL, and start the server, you cannot change it back to FULLYRESTRICTED or PROTECTINTERNAL. If you drop the database, in development or test mode for example, then you can decrease access.

The following illustration shows producer codes, groups, and users in an insurance company and external agencies. User A-1 belongs to the Agency 1 organization and is assigned to the Group-101 group.

If access is Fully Restricted, external user Scott can be assigned producer codes from the group and organization to which the user belongs. As a member of Group-101, Scott has producer code PC-101. Because Scott belongs to organization Agency 1, he can be assigned producer code PC-10.

If access is Protect Internal, Scott can additionally be assigned to any external groups. So Scott can be assigned to Group-102 and Group-201. Through membership in these groups, Scott picks up producer codes PC-102 and PC-201. Scott can also be assigned any external producer codes. Therefore, Scott can be assigned producer code PC-20.

If access is Allow Internal, Scott can additionally be assigned to any internal or external group. So Scott can be assigned to Group-1, picking up producer code PC-1. Scott can also be assigned any internal producer code. So Scott can be assigned producer code PC-00.