Data Security

22.2Data Access Control (DAC)

The Data Access Control [DIACCESS] menu contains options that allow creation and management of Data Access Control policies for VistA files. The menu is found on the Other Options [DIOTHER] menu and is intended for site managers and developers who maintain policy-based access rules above and beyond the file- and field-level security controls described in the Security at the File Level, Protection for Fields in a File, and Protection for Templates sections.

A DAC policy binds an application action (an application-defined operation such as "view chart" or "modify entry") to a policy function (M code that evaluates whether the action is permitted under given conditions). When an application tests a policy against a user and an entry, the policy function runs and returns a Boolean result that the application acts on.

Selecting the menu with a question mark displays the following options (listed in menu-display order):

Select Other Options <TEST ACCOUNT> Option: DATA ACCESS CONTROL

   1   Set Up Application Actions      [DIAC ACTIONS]
   2   Edit/Create an Action Policy    [DIAC EDIT]
   3   Test a Policy                   [DIAC TEST]
   4   Disable a Policy                [DIAC DISABLE]
   5   Delete a Policy                 [DIAC DELETE]
   6   Print Actions/Policies          [DIAC PRINT]
   7   Policy Functions                [DIAC FUNCTIONS]

Select Data Access Control <TEST ACCOUNT> Option:

Set Up Application Actions

The Set Up Application Actions [DIAC ACTIONS] option provides access to the Application Action file. An application action is a named operation that an application defines and that DAC policies later bind to a policy function. Define the actions your application can perform before creating policies that reference them.

Edit/Create an Action Policy

The Edit/Create an Action Policy [DIAC EDIT] option provides access to the DAC Policy Editor. Use it to create a new policy or edit an existing policy, binding an application action to a policy function and configuring policy parameters.

Test a Policy

The Test a Policy [DIAC TEST] option lets you run a DAC policy against test inputs and observe the result. Use it to verify that a policy behaves as intended before relying on it in production applications.

Disable a Policy

The Disable a Policy [DIAC DISABLE] option provides a quick way to disable a policy without deleting it. A disabled policy remains in the policy file but is not evaluated when an application tests against it. Re-enable the policy by editing it through the Edit/Create an Action Policy option.

Delete a Policy

The Delete a Policy [DIAC DELETE] option removes a policy entirely from the policy file. Unlike Disable a Policy, deletion is permanent.

Print Actions/Policies

The Print Actions/Policies [DIAC PRINT] option prints a list of application actions and policies, or the details of a single policy. Use it to review the policy set in place at the site or to document a specific policy's configuration.

Policy Functions

The Policy Functions [DIAC FUNCTIONS] option provides access to the Policy Function file. A policy function is an M-code function that, when invoked by a policy, returns a Boolean indicating whether the bound application action is permitted. Policy functions are the building blocks that policies compose into access rules.

Reviewed/Updated: June 2026