MarkLogic supports role-based access control for all entities/documents maintained within the database. User roles and applied document permissions determine access. For example, if a document has read permission for role1 and read permission for role2, a user who possesses either role1 or role2 can read that document. Permissions in this example are evaluated using OR semantics. Adding a Compartment to a role ensures access controls are evaluated using AND semantics when determining user access to a given resource. This security level is applied to the entire document/resource. 1. Verify applicable roles are configured with the necessary access Compartments for the specified role. 2. Verify all documents inserted into the MarkLogic database have the applicable permission (Compartment) applied. If applicable roles do not have Compartments defined, this is a finding. If documents inserted into the database do not have the applicable document permissions (Compartments) applied, this is a finding. Additionally, MarkLogic can enforce Element Level Security and Element Redaction ensuring users can only access specific elements of information they are permitted to access. Data a user is not permitted to see may be redacted or excluded all together. Element Level Security also ensures document searches do not return results where the search value is within an Element the user does not have access to. This security level is applied to specified elements within a given document. When/where applicable: 1. Navigate to the MarkLogic Admin page >> Security >> Protected Paths. 2. Verify the applicable elements requiring additional protections are defined using an XQuery path expression (applicable for both XML and JSON document types). 3. Verify the applicable role(s) are added against the specified path expression. If specific document elements require additional protections and no Protected Paths or Protect Path roles are defined, this is a finding.