• First, a new ScopeId is generated in the application which is used to identify the Space. The ScopeId typically looks like this: "s870843cf_3ab1_42eb_8b31_d14df6c3fe20".

• For every ScopeId, the Spaces app seeds at least 3 application Roles in the policy Store which corresponds to the default user types in a Space. ie, Moderator, Participant and Viewer: 

• Right after a space is created, the Spaces application creates a folder right under the root spaces folder in UCM. The ScopeId is used to construct a UCM account for this new folder.

• Now, Space administrators can go and assign Moderator/Participant/Viewer roles to different users from the Identity Store. Imagine you have the following members:

• If you go back to UCM and login with all the 3 users, you will see that they have roughly the same accounts and roles.

•  In UCM, you can see a document only if the document's Account and Role matches with yours. Your actual access(RWDA) is determined by the intersection of your Role and Account's Permissions.

• So next question arises: How is Brian restricted to create a document in UCM under this Space folder when he and Bob has the same roles and accounts. The answer is "UCM Extended User Attributes". The implementation of this is hidden and Spaces manages all the finer level access control using extendeduserattributes. You can read more about it here.
• You can verify  the extended user attributes by querying the USEREXTENDEDATTRIBUTES table in UCM. Or you can invoke the QUERY_EXTENDED_USER_ATTRIBUTES service (details here)
• Typically rows in the UCM table will look like this: The  DATTRIBUTEPRIVILEGE column will contain integer values signifying the permissions. They follow the unix permission syntax for RWD access.
• Below is a java program to read the extended user attributes using the UCM Service:

 public static void main(String[] args)throws Exception{  
     IdcClientManager manager = new IdcClientManager();  
     IdcClient idcClient;  
       idcClient = manager.createClient("idc://localhost:4444");  
       IdcContext userContext = new IdcContext("sysadmin", "welcome1");  
       ServiceResponse response;  
           String user = "smishra1";  
           DataBinder dataBinder = idcClient.createBinder();  
           dataBinder.getLocalData();  
           dataBinder.putLocal("IdcService", "QUERY_EXTENDED_USER_ATTRIBUTES");  
           dataBinder.putLocal("dName", user);  
           response = idcClient.sendRequest(userContext, dataBinder);  
           DataBinder serverBinder = response.getResponseAsBinder();  
           DataResultSet userAttribInfo =  
             serverBinder.getResultSet("ExtUserAttribInfo");   
           System.out.println("----------------Printing extended User Attributes for "+user);  
           for(DataObject obj : userAttribInfo.getRows()){  
             System.out.println("       Application: "+obj.get("dApplication"));  
             System.out.println("       Attributes : "+obj.get("AttributeInfo"));  
           }  
   }