Keep the reference clear
Identify the revision or released definition behind an exchange so the recipient knows what the information describes.
IP SecurityIP Security.
IP Security.
Share with purpose.
Give collaborators the product information their work needs. Keep access tied to the person, the record and the action—not simply the ability to sign in.
Explore the protection layersProtect the knowledge behind the productProduct knowledge has value.
Product knowledge has value.
Give access a purpose.
IP protection for digital assets is the deliberate control of who can find, use and change the engineering information that gives a product its value. In PLM, that information includes design files and the relationships, specifications and decisions that make those files meaningful.
The aim is to support a legitimate engineering task while limiting unnecessary exposure. A supplier reviewing a released drawing may need its revision and material specification, but not the wider development history or every model in the assembly.
Explore product data management
- Design knowledge
- CAD models, drawings and visualization files carry geometry and manufacturing intent.
- Product context
- Parts, specifications and their relationships explain where information belongs and which version applies.
- Working decisions
- Review records, change discussions and supporting documents can contain knowledge beyond the design itself.
Turn a collaboration purpose into an access modelFrom a sharing request.
From a sharing request.
To deliberate access.
Start with the information to be shared, the people receiving it and the operations their task requires. Translate that scope into configured identity, permission and clearance rules; then test representative access before inviting a wider audience.
- Establish identity and ownership
- Authentication, including SSO where configured, identifies the participant. Assign responsibility for maintaining their organization, group membership and access approval.
- Define the permitted task
- Match object permissions to the work. Reading record attributes, downloading files and changing content are different operations; do not treat them as one blanket entitlement.
- Apply information boundaries
- Use configured security labels and, where enabled, active agreements to express clearance and time-bounded participation. Check both permission and clearance for the complete task.
- Review access in operation
- Exercise intended and excluded access cases, review available audit events and revisit participation when the assignment changes. Agree separate handling for files delivered outside PLM.
Keep the record at the center of the decisionFollow the record.
Follow the record.
Define every exchange.
Product information moves between engineering, manufacturing and external partners. A data-centric approach starts with the authoritative record and its sensitivity, rather than assuming that every person inside a network needs the same access.
PLM can provide the product reference for these exchanges. When connecting ERP, manufacturing or supplier environments, define which records cross each boundary, which system owns the receiving copy and how changes are communicated. Protection depends on the configured interface and receiving environment as well as the source controls.
Managed product-data environmentAuthoritative product recordVersion · relationships · sensitivity
Reviewed exchange boundary
- Engineering review
- Manufacturing handoff
- Partner collaboration
Limit the information crossing
Select the records and representation needed for the receiving task. A visualization and a complete native model can reveal different levels of detail.
Account for the receiving copy
Define retention, refresh and onward-sharing responsibilities. Revoking access in PLM does not establish that a previously delivered copy has been recalled.
Connect policy to product-data operationsPermissions. Sharing. Review.
Permissions. Sharing. Review.
Put protection into practice.
Use the controls together around a real collaboration task. The capability groups below distinguish the access decision, the information delivered and the activity available for investigation; they are not interchangeable layers.
Decide who can do what
Object permissions and clearance define the working boundary.
Object permissions and ACLs
Map participants, object types and lifecycle states to allowed operations. Read, Download, Modify and Modify Content have different purposes, and an operation may depend on several permissions.
Security labels
Attach configured clearance conditions to sensitive objects. A participant needs the appropriate permission and clearance for every applicable label; identity alone is insufficient.
Active agreements
Where enabled, an agreement can supply label clearance to specified participants for applicable objects or contexts within defined dates. It does not remove the underlying permission requirements.
Control the information shared
Choose records, representations and collaboration scope deliberately.
Supplier and contractor record context
Manage part references, history and configured release notifications around the participants who need them. Keep the supplier’s working scope distinct from the full internal product definition.
MCAD, ECAD and visualization
Select relevant design information and review the detail present in a shared representation. Available publishing, simplification and data-removal options depend on the applications, formats and configuration.
Problem reporting
Associate an issue with affected parts or assemblies so the responsible team can investigate it in product context. An issue record does not by itself approve a change or establish a security incident response.
Make activity reviewable
Review evidence and operating responsibilities alongside configuration.
Security audit events
Configured auditing can record security-related activity for investigation. Confirm which events are collected, who reviews them and the retention needs of your environment.
Identity and operating controls
Combine authenticated participation with maintained groups, reviewed configuration and a defined administration process. Product access rules complement the wider security practices of the organization.
Confirm release, applications, licensing and enabled security-label, agreement, publishing and audit configuration for the proposed environment. No single control guarantees protection after information leaves the managed system.
Choose the product role before the access modelMatch the product.
Match the product.
To the task at hand.
Windchill provides the managed product-data foundation; Windchill Navigate extends selected tasks to a wider audience. Choose the access experience around the work, then validate its permissions and information scope in the intended environment.
Manage the product definition
Windchill
Bring engineering records, revisions and relationships into a governed PLM environment. Administrators can connect access rules to product objects, participant groups and lifecycle context, with additional label and agreement controls where configured.
Explore Windchill
Make specific tasks accessible
Windchill Navigate
Offer role- and task-based apps for people who need to view or contribute to selected product information. Evaluate the task, content and underlying access together; a simpler interface does not grant unrestricted access to the source records.
Explore Windchill NavigateBring one representative record, an internal role and an external participant. Use that small scope to discuss the right product experience and access responsibilities.
Discuss your product-data accessApply the discipline to a real product situationSensitive knowledge.
Sensitive knowledge.
Industry-specific boundaries.
Information sensitivity depends on the product and the collaboration task. These industry situations help define the records, audience and access boundary for an initial discussion.
Electronics & High-Tech
A design partner may need a board interface or enclosure reference without receiving the complete development record. Select the representation and related information deliberately.
What does the partner need to review without exposing unrelated design knowledge?
Aerospace & Defense
A program review can involve participants from several organizations. Identify the configuration, participant groups and information classifications that apply to the shared records.
Which program information belongs within this participant’s task?
MedTech
A device collaboration can involve design, quality and external specialist records. Identify the information owner and intended operation for each audience.
Who approves access to each part of the device review record?
Distinctions that matter in planningIP protection questions.
IP protection questions.
Define deliberate access.
Separate identity, allowed operations and information handling when defining your scope.
Does signing in give someone access to every product record?
No. Authentication identifies the participant. Access to an object and the operations available on it depend on the configured controls and any applicable security-label clearance.
Does security-label clearance replace a permission?
No. Clearance and permissions are separate requirements. A participant cleared for the labels still needs the appropriate access-control permissions for the intended action.
Is an agreement the same as unrestricted access?
No. An active agreement supplies label clearance within its applicable scope, conditions and dates. It does not remove the need for the underlying permissions.
Do these controls automatically protect every exported file?
Do not assume so. Define how information is handled after delivery, including the receiving environment and any separately configured protections. Access changes within PLM are not evidence that an already-delivered copy has been removed.
What should we bring to an initial discussion?
Bring a real collaboration task, representative records, intended participant groups and the owners of access decisions. Include the actions participants need to perform and any limits on the information being shared.
Your next product-data decisionProtect the knowledge.
Protect the knowledge.
Support the work.
Bring one collaboration request and the information it involves.
TriStar can help connect the engineering purpose with an appropriate access and configuration discussion.