User Guide

292 Administering ColdFusion Server
Resources are not secured until you specifically choose to protect them. You can secure
the following types of resources:
• Applications
• Verity Collections
• Components
• ColdFusion Tags
• ColdFusion Functions
• Custom Tags
• Data Sources
• Files and Directories
• User Objects
• Users
Policies
After you specify a resource to protect, you need to create a policy that gives access
rights to a set of users. A policy matches resources to users or user groups, that is, it
grants a group of users access to specified resources.
For example, you can create a policy that gives members of a team complete access to
three data sources that the team uses regularly. You could also create a policy that
specifies the system administrator as the only user who can use the CFFILE tag’s
WRITE action.
If you specify a resource to protect but do not include it in any policy, the resource is
fully protected within the Security Context — in other words, no users have access to
those resources.