feature[ats_VDYBJ]: Add framework access control service

33 files changed, 729 insertions, 206 deletions

diff --git a/plugins/org.eclipse.osee.ats.config.demo/src/org/eclipse/osee/ats/config/demo/config/AddDbInitDemoChoice.java b/plugins/org.eclipse.osee.ats.config.demo/src/org/eclipse/osee/ats/config/demo/config/AddDbInitDemoChoice.java
index 21dcb04e646..d4c844ece54 100644
--- a/plugins/org.eclipse.osee.ats.config.demo/src/org/eclipse/osee/ats/config/demo/config/AddDbInitDemoChoice.java
+++ b/plugins/org.eclipse.osee.ats.config.demo/src/org/eclipse/osee/ats/config/demo/config/AddDbInitDemoChoice.java
@@ -26,6 +26,7 @@ public class AddDbInitDemoChoice implements IAddDbInitChoice {
    public void addDbInitChoice(GroupSelection groupSelection) {
       DbInitConfiguration config = new DbInitConfiguration(false);
       config.addTask("org.eclipse.osee.ats.config.demo.AddCommonBranchForAtsDemo");
+      config.addTask("org.eclipse.osee.framework.access.provider.FrameworkAccessConfig");
       config.addTask("org.eclipse.osee.ats.config.demo.AtsConfigAddDemoUsers");
       config.addTask("org.eclipse.osee.framework.database.init.SimpleTemplateProviderTask");
       config.addTask("org.eclipse.osee.ats.AtsDatabaseConfig");
diff --git a/plugins/org.eclipse.osee.ats/OSGI-INF/ats.cm.access.xml b/plugins/org.eclipse.osee.ats/OSGI-INF/ats.cm.access.xml
new file mode 100644
index 00000000000..363888e0528
--- /dev/null
+++ b/plugins/org.eclipse.osee.ats/OSGI-INF/ats.cm.access.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<scr:component xmlns:scr="http://www.osgi.org/xmlns/scr/v1.1.0" activate="start" deactivate="stop" name="org.eclipse.osee.ats.internal.AtsCmAccessControlProxy">
+   <implementation class="org.eclipse.osee.ats.internal.AtsCmAccessControlProxy"/>
+   <service>
+      <provide interface="org.eclipse.osee.framework.core.services.CmAccessControl"/>
+      <provide interface="org.eclipse.osee.framework.core.model.access.HasAccessModel"/>
+   </service>
+   <reference bind="setAccessModelInterpreter" cardinality="1..1" interface="org.eclipse.osee.framework.core.dsl.integration.AccessModelInterpreter" name="AccessModelInterpreter" policy="static"/>
+</scr:component>
\ No newline at end of file
diff --git a/plugins/org.eclipse.osee.ats/OSGI-INF/service.provider.xml b/plugins/org.eclipse.osee.ats/OSGI-INF/service.provider.xml
deleted file mode 100644
index 56f0d2e4b0d..00000000000
--- a/plugins/org.eclipse.osee.ats/OSGI-INF/service.provider.xml
+++ /dev/null
@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<scr:component xmlns:scr="http://www.osgi.org/xmlns/scr/v1.1.0" activate="start" deactivate="stop" name="org.eclipse.osee.ats.internal.ServiceProvider">
-   <implementation class="org.eclipse.osee.ats.internal.ServiceProvider"/>
-   <reference bind="setOseeCmService" cardinality="1..1" interface="org.eclipse.osee.framework.ui.skynet.cm.IOseeCmService" name="IOseeCmService" policy="static"/>
-</scr:component>
diff --git a/plugins/org.eclipse.osee.ats/build.properties b/plugins/org.eclipse.osee.ats/build.properties
index 3ec56aaf8bc..4cfd33e9b37 100644
--- a/plugins/org.eclipse.osee.ats/build.properties
+++ b/plugins/org.eclipse.osee.ats/build.properties
@@ -1,4 +1,3 @@
-source.. = src/
 output.. = bin/
 bin.includes = META-INF/,\
                .,\
@@ -8,3 +7,5 @@ bin.includes = META-INF/,\
                schema/,\
                ui/,\
                OSGI-INF/
+source.. = src/
+additional.bundles = org.eclipse.osee.framework.access.provider
diff --git a/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/access/AtsBranchAccessManager.java b/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/access/AtsBranchAccessManager.java
index 3d4504c1544..0882f0eb8cf 100644
--- a/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/access/AtsBranchAccessManager.java
+++ b/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/access/AtsBranchAccessManager.java
@@ -29,6 +29,7 @@ import org.eclipse.osee.ats.util.AtsUtil;
 import org.eclipse.osee.framework.core.data.IAccessContextId;
 import org.eclipse.osee.framework.core.data.IOseeBranch;
 import org.eclipse.osee.framework.core.data.TokenFactory;
+import org.eclipse.osee.framework.core.dsl.integration.RoleContextProvider;
 import org.eclipse.osee.framework.core.enums.CoreAttributeTypes;
 import org.eclipse.osee.framework.core.enums.SystemUser;
 import org.eclipse.osee.framework.core.exception.OseeCoreException;
@@ -70,8 +71,15 @@ public class AtsBranchAccessManager implements IArtifactEventListener, IAccessCo
    private static List<Long> atsConfigArtifactTypes = Arrays.asList(AtsArtifactTypes.ActionableItem.getGuid(),
       AtsArtifactTypes.TeamDefinition.getGuid());
 
+   private final RoleContextProvider roleContextProvider;
+
    public AtsBranchAccessManager() {
+      this(null);
+   }
+
+   public AtsBranchAccessManager(RoleContextProvider roleContextProvider) {
       OseeEventManager.addListener(this);
+      this.roleContextProvider = roleContextProvider;
    }
 
    public void dispose() {
@@ -127,6 +135,9 @@ public class AtsBranchAccessManager implements IArtifactEventListener, IAccessCo
             } else {
                contextIds.add(AtsBranchAccessContextId.DEFAULT_BRANCH_CONTEXT);
             }
+            if (roleContextProvider != null) {
+               contextIds.addAll(roleContextProvider.getContextId(UserManager.getUser()));
+            }
          }
       } catch (OseeCoreException ex) {
          OseeLog.log(Activator.class, Level.SEVERE, "Exception obtaining Branch Access Context Id; Deny returned", ex);
diff --git a/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/Activator.java b/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/Activator.java
index 72938b1ad48..af129cf1257 100644
--- a/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/Activator.java
+++ b/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/Activator.java
@@ -18,7 +18,6 @@ import org.eclipse.osee.ats.util.AtsBranchManager;
 import org.eclipse.osee.framework.core.client.ClientSessionManager;
 import org.eclipse.osee.framework.core.exception.OseeAuthenticationRequiredException;
 import org.eclipse.osee.framework.core.util.OsgiUtil;
-import org.eclipse.osee.framework.core.util.ServiceDependencyTracker;
 import org.eclipse.osee.framework.logging.OseeLog;
 import org.eclipse.osee.framework.plugin.core.IActionReportingService;
 import org.eclipse.osee.framework.ui.skynet.cm.IOseeCmService;
@@ -35,7 +34,6 @@ public class Activator implements BundleActivator {
 
    private ServiceRegistration service1;
    private ServiceRegistration service2;
-   private ServiceDependencyTracker tracker;
 
    private volatile boolean needsInitialization = true;
 
@@ -47,9 +45,6 @@ public class Activator implements BundleActivator {
          context.registerService(IActionReportingService.class.getName(), new AtsActionReportingServiceImpl(), null);
       service2 = context.registerService(IOseeCmService.class.getName(), new OseeAtsServiceImpl(), null);
 
-      tracker = new ServiceDependencyTracker(context, new AtsCmAccessControlRegHandler());
-      tracker.open();
-
       Runnable runnable = new Runnable() {
          @Override
          public void run() {
@@ -79,7 +74,6 @@ public class Activator implements BundleActivator {
          thread = null;
       }
       AtsBranchManager.stop();
-      OsgiUtil.close(tracker);
       OsgiUtil.close(service1);
       OsgiUtil.close(service2);
    }
diff --git a/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/AtsAccessOseeDslProvider.java b/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/AtsAccessOseeDslProvider.java
index 7007b2926a9..2ffe151cd1a 100644
--- a/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/AtsAccessOseeDslProvider.java
+++ b/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/AtsAccessOseeDslProvider.java
@@ -10,19 +10,12 @@
  *******************************************************************************/
 package org.eclipse.osee.ats.internal;
 
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
 import org.eclipse.osee.ats.access.AtsAccessUtil;
-import org.eclipse.osee.framework.core.dsl.integration.OseeDslProvider;
-import org.eclipse.osee.framework.core.dsl.integration.util.ModelUtil;
-import org.eclipse.osee.framework.core.dsl.oseeDsl.OseeDsl;
-import org.eclipse.osee.framework.core.dsl.ui.integration.operations.OseeTypesExportOperation;
+import org.eclipse.osee.framework.core.dsl.ui.integration.operations.AbstractOseeDslProvider;
 import org.eclipse.osee.framework.core.enums.CoreArtifactTypes;
 import org.eclipse.osee.framework.core.enums.CoreAttributeTypes;
 import org.eclipse.osee.framework.core.exception.OseeCoreException;
-import org.eclipse.osee.framework.core.exception.OseeExceptions;
-import org.eclipse.osee.framework.core.operation.IOperation;
-import org.eclipse.osee.framework.core.operation.Operations;
+import org.eclipse.osee.framework.jdk.core.util.Strings;
 import org.eclipse.osee.framework.skynet.core.artifact.Artifact;
 import org.eclipse.osee.framework.skynet.core.artifact.BranchManager;
 import org.eclipse.osee.framework.skynet.core.artifact.search.ArtifactQuery;
@@ -30,50 +23,37 @@ import org.eclipse.osee.framework.skynet.core.artifact.search.ArtifactQuery;
 /**
  * @author Roberto E. Escobar
  */
-public class AtsAccessOseeDslProvider implements OseeDslProvider {
+public class AtsAccessOseeDslProvider extends AbstractOseeDslProvider {
 
-   private OseeDsl oseeDsl;
-
-   private Artifact getStorageArtifact() throws OseeCoreException {
-      return ArtifactQuery.getArtifactFromTypeAndName(CoreArtifactTypes.AccessControlModel,
-         AtsAccessUtil.ATS_ACCESS_MODEL_NAME, BranchManager.getCommonBranch());
+   public AtsAccessOseeDslProvider(String locationUri) {
+      super(locationUri);
    }
 
-   @Override
-   public void loadDsl() throws OseeCoreException {
-      Artifact artifact = getStorageArtifact();
-      String accessModel = artifact.getSoleAttributeValue(CoreAttributeTypes.GeneralStringData);
-
-      ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
-      IOperation operation = new OseeTypesExportOperation(outputStream);
-      Operations.executeWorkAndCheckStatus(operation);
+   private Artifact getStorageArtifact() {
       try {
-         outputStream.write(accessModel.getBytes("utf-8"));
-         oseeDsl = ModelUtil.loadModel("ats:/xtext/cm.access.osee", outputStream.toString("utf-8"));
-      } catch (Exception ex) {
-         OseeExceptions.wrapAndThrow(ex);
+         return ArtifactQuery.getArtifactFromTypeAndName(CoreArtifactTypes.AccessControlModel,
+            AtsAccessUtil.ATS_ACCESS_MODEL_NAME, BranchManager.getCommonBranch());
+      } catch (OseeCoreException ex) {
+         return null;
       }
    }
 
    @Override
-   public OseeDsl getDsl() throws OseeCoreException {
-      if (oseeDsl == null) {
-         loadDsl();
+   protected String getModelFromStorage() throws OseeCoreException {
+      Artifact storageArtifact = getStorageArtifact();
+      if (storageArtifact != null) {
+         return storageArtifact.getSoleAttributeValue(CoreAttributeTypes.GeneralStringData);
+      } else {
+         return Strings.EMPTY_STRING;
       }
-      return oseeDsl;
    }
 
    @Override
-   public void storeDsl(OseeDsl dsl) throws OseeCoreException {
-      ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
-      try {
-         ModelUtil.saveModel(dsl, "ats:/xtext/cm.access.osee", outputStream, false);
-         Artifact artifact = getStorageArtifact();
-         artifact.setSoleAttributeFromString(CoreAttributeTypes.GeneralStringData, outputStream.toString("UTF-8"));
+   protected void saveModelToStorage(String model) throws OseeCoreException {
+      Artifact artifact = getStorageArtifact();
+      if (artifact != null) {
+         artifact.setSoleAttributeFromString(CoreAttributeTypes.GeneralStringData, model);
          artifact.persist(getClass().getSimpleName());
-         loadDsl();
-      } catch (IOException ex) {
-         OseeExceptions.wrapAndThrow(ex);
       }
    }
 }
diff --git a/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/AtsCmAccessControl.java b/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/AtsCmAccessControl.java
index 1527993ce51..1c3ccdbaa2c 100644
--- a/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/AtsCmAccessControl.java
+++ b/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/AtsCmAccessControl.java
@@ -18,8 +18,6 @@ import org.eclipse.osee.ats.util.AtsUtil;
 import org.eclipse.osee.framework.core.data.IAccessContextId;
 import org.eclipse.osee.framework.core.data.IOseeBranch;
 import org.eclipse.osee.framework.core.model.IBasicArtifact;
-import org.eclipse.osee.framework.core.model.access.AccessModel;
-import org.eclipse.osee.framework.core.model.access.HasAccessModel;
 import org.eclipse.osee.framework.core.services.CmAccessControl;
 import org.eclipse.osee.framework.skynet.core.artifact.Artifact;
 
@@ -29,13 +27,11 @@ import org.eclipse.osee.framework.skynet.core.artifact.Artifact;
  * @author Roberto E. Escobar
  * @author Donald G. Dunne
  */
-public class AtsCmAccessControl implements CmAccessControl, HasAccessModel {
+public class AtsCmAccessControl implements CmAccessControl {
 
-   private final AccessModel accessModel;
    private final AtsBranchAccessManager atsBranchAccessManager;
 
-   public AtsCmAccessControl(AccessModel accessModel, AtsBranchAccessManager atsBranchObjectManager) {
-      this.accessModel = accessModel;
+   public AtsCmAccessControl(AtsBranchAccessManager atsBranchObjectManager) {
       this.atsBranchAccessManager = atsBranchObjectManager;
    }
 
@@ -55,11 +51,6 @@ public class AtsCmAccessControl implements CmAccessControl, HasAccessModel {
    }
 
    @Override
-   public AccessModel getAccessModel() {
-      return accessModel;
-   }
-
-   @Override
    public Collection<? extends IAccessContextId> getContextId(IBasicArtifact<?> user, Object object) {
       AtsBulkLoad.loadConfig(true);
       if (object != null) {
diff --git a/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/AtsCmAccessControlProxy.java b/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/AtsCmAccessControlProxy.java
new file mode 100644
index 00000000000..b427ca59850
--- /dev/null
+++ b/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/AtsCmAccessControlProxy.java
@@ -0,0 +1,89 @@
+/*******************************************************************************
+ * Copyright (c) 2004, 2007 Boeing.
+ * All rights reserved. This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License v1.0
+ * which accompanies this distribution, and is available at
+ * http://www.eclipse.org/legal/epl-v10.html
+ *
+ * Contributors:
+ *     Boeing - initial API and implementation
+ *******************************************************************************/
+package org.eclipse.osee.ats.internal;
+
+import java.util.Collection;
+import org.eclipse.osee.ats.access.AtsBranchAccessManager;
+import org.eclipse.osee.framework.core.data.IAccessContextId;
+import org.eclipse.osee.framework.core.dsl.integration.AccessModelInterpreter;
+import org.eclipse.osee.framework.core.dsl.integration.OseeDslAccessModel;
+import org.eclipse.osee.framework.core.dsl.integration.OseeDslProvider;
+import org.eclipse.osee.framework.core.dsl.integration.RoleContextProvider;
+import org.eclipse.osee.framework.core.dsl.ui.integration.operations.OseeDslRoleContextProvider;
+import org.eclipse.osee.framework.core.exception.OseeCoreException;
+import org.eclipse.osee.framework.core.model.IBasicArtifact;
+import org.eclipse.osee.framework.core.model.access.AccessModel;
+import org.eclipse.osee.framework.core.model.access.HasAccessModel;
+import org.eclipse.osee.framework.core.services.CmAccessControl;
+import org.eclipse.osee.framework.skynet.core.event.OseeEventManager;
+import org.eclipse.osee.framework.skynet.core.event.listener.IEventListener;
+
+/**
+ * @author Roberto E. Escobar
+ */
+public class AtsCmAccessControlProxy implements CmAccessControl, HasAccessModel {
+
+   private IEventListener listener;
+   private AtsBranchAccessManager atsBranchObjectManager;
+   private AccessModelInterpreter accessModelInterpreter;
+   private CmAccessControl cmService;
+   private AccessModel accessModel;
+
+   public void setAccessModelInterpreter(AccessModelInterpreter accessModelInterpreter) {
+      this.accessModelInterpreter = accessModelInterpreter;
+   }
+
+   public void start() {
+      OseeDslProvider dslProvider = new AtsAccessOseeDslProvider("ats:/xtext/cm.access.osee");
+      accessModel = new OseeDslAccessModel(accessModelInterpreter, dslProvider);
+      RoleContextProvider roleAccessProvider = new OseeDslRoleContextProvider(dslProvider);
+
+      atsBranchObjectManager = new AtsBranchAccessManager(roleAccessProvider);
+      cmService = new AtsCmAccessControl(atsBranchObjectManager);
+
+      listener = new AtsDslProviderUpdateListener(dslProvider);
+      OseeEventManager.addListener(listener);
+   }
+
+   public void stop() {
+      if (listener != null) {
+         OseeEventManager.removeListener(listener);
+         listener = null;
+      }
+
+      if (atsBranchObjectManager != null) {
+         atsBranchObjectManager.dispose();
+         atsBranchObjectManager = null;
+      }
+      cmService = null;
+      accessModel = null;
+   }
+
+   private CmAccessControl getProxiedService() {
+      return cmService;
+   }
+
+   @Override
+   public boolean isApplicable(IBasicArtifact<?> user, Object object) {
+      return getProxiedService().isApplicable(user, object);
+   }
+
+   @Override
+   public Collection<? extends IAccessContextId> getContextId(IBasicArtifact<?> user, Object object) throws OseeCoreException {
+      return getProxiedService().getContextId(user, object);
+   }
+
+   @Override
+   public AccessModel getAccessModel() {
+      return accessModel;
+   }
+
+}
diff --git a/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/AtsCmAccessControlRegHandler.java b/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/AtsCmAccessControlRegHandler.java
deleted file mode 100644
index 6d478f83893..00000000000
--- a/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/AtsCmAccessControlRegHandler.java
+++ /dev/null
@@ -1,83 +0,0 @@
-/*******************************************************************************
- * Copyright (c) 2004, 2007 Boeing.
- * All rights reserved. This program and the accompanying materials
- * are made available under the terms of the Eclipse Public License v1.0
- * which accompanies this distribution, and is available at
- * http://www.eclipse.org/legal/epl-v10.html
- *
- * Contributors:
- *     Boeing - initial API and implementation
- *******************************************************************************/
-package org.eclipse.osee.ats.internal;
-
-import java.util.HashMap;
-import java.util.Map;
-import org.eclipse.osee.ats.access.AtsBranchAccessManager;
-import org.eclipse.osee.framework.core.dsl.integration.AccessModelInterpreter;
-import org.eclipse.osee.framework.core.dsl.integration.OseeDslAccessModel;
-import org.eclipse.osee.framework.core.dsl.integration.OseeDslProvider;
-import org.eclipse.osee.framework.core.model.access.AccessModel;
-import org.eclipse.osee.framework.core.services.CmAccessControl;
-import org.eclipse.osee.framework.core.util.AbstractTrackingHandler;
-import org.eclipse.osee.framework.core.util.ServiceBindType;
-import org.eclipse.osee.framework.skynet.core.event.OseeEventManager;
-import org.eclipse.osee.framework.skynet.core.event.listener.IEventListener;
-import org.osgi.framework.BundleContext;
-import org.osgi.framework.ServiceRegistration;
-
-/**
- * @author Roberto E. Escobar
- */
-public class AtsCmAccessControlRegHandler extends AbstractTrackingHandler {
-
-   private final Map<Class<?>, ServiceBindType> serviceDeps = new HashMap<Class<?>, ServiceBindType>();
-
-   private ServiceRegistration registration;
-   private IEventListener listener;
-
-   private AtsBranchAccessManager atsBranchObjectManager;
-
-   public AtsCmAccessControlRegHandler() {
-      serviceDeps.put(AccessModelInterpreter.class, ServiceBindType.SINGLETON);
-   }
-
-   @Override
-   public Class<?>[] getDependencies() {
-      return null;
-   }
-
-   @Override
-   public Map<Class<?>, ServiceBindType> getConfiguredDependencies() {
-      return serviceDeps;
-   }
-
-   @Override
-   public void onActivate(BundleContext context, Map<Class<?>, Object> services) {
-      AccessModelInterpreter interpreter = getService(AccessModelInterpreter.class, services);
-
-      OseeDslProvider dslProvider = new AtsAccessOseeDslProvider();
-      AccessModel accessModel = new OseeDslAccessModel(interpreter, dslProvider);
-
-      atsBranchObjectManager = new AtsBranchAccessManager();
-      CmAccessControl cmService = new AtsCmAccessControl(accessModel, atsBranchObjectManager);
-      registration = context.registerService(CmAccessControl.class.getName(), cmService, null);
-
-      listener = new OseeDslProviderUpdateListener(dslProvider);
-      OseeEventManager.addListener(listener);
-   }
-
-   @Override
-   public void onDeActivate() {
-      if (listener != null) {
-         OseeEventManager.removeListener(listener);
-         if (atsBranchObjectManager != null) {
-            atsBranchObjectManager.dispose();
-         }
-         listener = null;
-      }
-      if (registration != null) {
-         registration.unregister();
-      }
-   }
-
-}
diff --git a/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/OseeDslProviderUpdateListener.java b/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/AtsDslProviderUpdateListener.java
index f053b154b26..d6f7d69762f 100644
--- a/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/OseeDslProviderUpdateListener.java
+++ b/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/AtsDslProviderUpdateListener.java
@@ -28,7 +28,7 @@ import org.eclipse.osee.framework.skynet.core.event.model.Sender;
 /**
  * @author Roberto E. Escobar
  */
-public final class OseeDslProviderUpdateListener implements IArtifactEventListener {
+public final class AtsDslProviderUpdateListener implements IArtifactEventListener {
 
    //@formatter:off
    private static final List<? extends IEventFilter> eventFilters =
@@ -40,7 +40,7 @@ public final class OseeDslProviderUpdateListener implements IArtifactEventListen
 
    private final OseeDslProvider dslProvider;
 
-   public OseeDslProviderUpdateListener(OseeDslProvider dslProvider) {
+   public AtsDslProviderUpdateListener(OseeDslProvider dslProvider) {
       this.dslProvider = dslProvider;
    }
 
diff --git a/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/ServiceProvider.java b/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/ServiceProvider.java
deleted file mode 100644
index 7c72d735d04..00000000000
--- a/plugins/org.eclipse.osee.ats/src/org/eclipse/osee/ats/internal/ServiceProvider.java
+++ /dev/null
@@ -1,37 +0,0 @@
-/*******************************************************************************
- * Copyright (c) 2011 Boeing.
- * All rights reserved. This program and the accompanying materials
- * are made available under the terms of the Eclipse Public License v1.0
- * which accompanies this distribution, and is available at
- * http://www.eclipse.org/legal/epl-v10.html
- *
- * Contributors:
- *     Boeing - initial API and implementation
- *******************************************************************************/
-package org.eclipse.osee.ats.internal;
-
-import org.eclipse.osee.framework.ui.skynet.cm.IOseeCmService;
-
-/**
- * @author Ryan D. Brooks
- */
-public class ServiceProvider {
-   private IOseeCmService service;
-   private static ServiceProvider instance;
-
-   public void setOseeCmService(IOseeCmService service) {
-      this.service = service;
-   }
-
-   public static IOseeCmService getOseeCmService() {
-      return instance.service;
-   }
-
-   public void start() {
-      instance = this;
-   }
-
-   public void stop() {
-      instance = null;
-   }
-}
diff --git a/plugins/org.eclipse.osee.client.parent/pom.xml b/plugins/org.eclipse.osee.client.parent/pom.xml
index 4f4067cf7a3..a66b70d5ad3 100644
--- a/plugins/org.eclipse.osee.client.parent/pom.xml
+++ b/plugins/org.eclipse.osee.client.parent/pom.xml
@@ -11,6 +11,7 @@
 
 	<modules>
 		<module>../../plugins/org.eclipse.osee.framework.access</module>
+		<module>../../plugins/org.eclipse.osee.framework.access.provider</module>
 		<module>../../plugins/org.eclipse.osee.framework.core.client</module>
 
 		<module>../../plugins/org.eclipse.osee.support.test.util</module>
diff --git a/plugins/org.eclipse.osee.framework.access.provider/.classpath b/plugins/org.eclipse.osee.framework.access.provider/.classpath
new file mode 100644
index 00000000000..ad32c83a788
--- /dev/null
+++ b/plugins/org.eclipse.osee.framework.access.provider/.classpath
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<classpath>
+	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/JavaSE-1.6"/>
+	<classpathentry kind="con" path="org.eclipse.pde.core.requiredPlugins"/>
+	<classpathentry kind="src" path="src"/>
+	<classpathentry kind="output" path="bin"/>
+</classpath>
diff --git a/plugins/org.eclipse.osee.framework.access.provider/.project b/plugins/org.eclipse.osee.framework.access.provider/.project
new file mode 100644
index 00000000000..013f2b81c43
--- /dev/null
+++ b/plugins/org.eclipse.osee.framework.access.provider/.project
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>org.eclipse.osee.framework.access.provider</name>
+	<comment></comment>
+	<projects>
+	</projects>
+	<buildSpec>
+		<buildCommand>
+			<name>org.eclipse.jdt.core.javabuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+		<buildCommand>
+			<name>org.eclipse.pde.ManifestBuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+		<buildCommand>
+			<name>org.eclipse.pde.SchemaBuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+		<buildCommand>
+			<name>org.eclipse.pde.ds.core.builder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+	</buildSpec>
+	<natures>
+		<nature>org.eclipse.pde.PluginNature</nature>
+		<nature>org.eclipse.jdt.core.javanature</nature>
+	</natures>
+</projectDescription>
diff --git a/plugins/org.eclipse.osee.framework.access.provider/META-INF/MANIFEST.MF b/plugins/org.eclipse.osee.framework.access.provider/META-INF/MANIFEST.MF
new file mode 100644
index 00000000000..58341ceb053
--- /dev/null
+++ b/plugins/org.eclipse.osee.framework.access.provider/META-INF/MANIFEST.MF
@@ -0,0 +1,31 @@
+Manifest-Version: 1.0
+Bundle-ManifestVersion: 2
+Bundle-Name: Framework Access Provider
+Bundle-SymbolicName: org.eclipse.osee.framework.access.provider;singleton:=true
+Bundle-Version: 0.9.9.qualifier
+Bundle-Vendor: Eclipse Open System Engineering Environment
+Bundle-RequiredExecutionEnvironment: JavaSE-1.6
+Import-Package: org.eclipse.core.runtime,
+ org.eclipse.osee.framework.core.data,
+ org.eclipse.osee.framework.core.dsl.integration,
+ org.eclipse.osee.framework.core.dsl.oseeDsl,
+ org.eclipse.osee.framework.core.dsl.ui.integration.operations,
+ org.eclipse.osee.framework.core.enums,
+ org.eclipse.osee.framework.core.exception,
+ org.eclipse.osee.framework.core.model,
+ org.eclipse.osee.framework.core.model.access,
+ org.eclipse.osee.framework.core.services,
+ org.eclipse.osee.framework.core.util,
+ org.eclipse.osee.framework.database.init,
+ org.eclipse.osee.framework.jdk.core.util,
+ org.eclipse.osee.framework.logging,
+ org.eclipse.osee.framework.skynet.core.artifact,
+ org.eclipse.osee.framework.skynet.core.artifact.search,
+ org.eclipse.osee.framework.skynet.core.event,
+ org.eclipse.osee.framework.skynet.core.event.filter,
+ org.eclipse.osee.framework.skynet.core.event.listener,
+ org.eclipse.osee.framework.skynet.core.event.model,
+ org.eclipse.osee.framework.skynet.core.transaction,
+ org.osgi.framework
+Service-Component: OSGI-INF/*.xml
+Bundle-ActivationPolicy: lazy
diff --git a/plugins/org.eclipse.osee.framework.access.provider/OSGI-INF/framework.access.control.xml b/plugins/org.eclipse.osee.framework.access.provider/OSGI-INF/framework.access.control.xml
new file mode 100644
index 00000000000..08d31ec85d8
--- /dev/null
+++ b/plugins/org.eclipse.osee.framework.access.provider/OSGI-INF/framework.access.control.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<scr:component xmlns:scr="http://www.osgi.org/xmlns/scr/v1.1.0" activate="start" deactivate="stop" name="org.eclipse.osee.framework.access.provider.internal.FrameworkAccessControlProxy">
+   <implementation class="org.eclipse.osee.framework.access.provider.internal.FrameworkAccessControlProxy"/>
+   <service>
+      <provide interface="org.eclipse.osee.framework.core.services.CmAccessControl"/>
+      <provide interface="org.eclipse.osee.framework.core.model.access.HasAccessModel"/>
+   </service>
+   <property name="default" type="Boolean" value="true"/>
+   <reference bind="setAccessModelInterpreter" cardinality="1..1" interface="org.eclipse.osee.framework.core.dsl.integration.AccessModelInterpreter" name="AccessModelInterpreter" policy="static"/>
+</scr:component>
diff --git a/plugins/org.eclipse.osee.framework.access.provider/build.properties b/plugins/org.eclipse.osee.framework.access.provider/build.properties
new file mode 100644
index 00000000000..d7b4030ecaf
--- /dev/null
+++ b/plugins/org.eclipse.osee.framework.access.provider/build.properties
@@ -0,0 +1,9 @@
+output.. = bin/
+bin.includes = META-INF/,\
+               .,\
+               plugin.xml,\
+               OSGI-INF/
+source.. = src/
+additional.bundles = org.eclipse.osee.framework.core,\
+                     org.eclipse.osee.framework.core.model,\
+                     org.eclipse.osee.framework.skynet.core
diff --git a/plugins/org.eclipse.osee.framework.access.provider/plugin.xml b/plugins/org.eclipse.osee.framework.access.provider/plugin.xml
new file mode 100644
index 00000000000..5774acb0c18
--- /dev/null
+++ b/plugins/org.eclipse.osee.framework.access.provider/plugin.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<?eclipse version="3.4"?>
+<plugin>
+   <extension
+         id="FrameworkAccessConfig"
+         name="FrameworkAccessConfig"
+         point="org.eclipse.osee.framework.database.init.DatabaseInitializationTask">
+      <DatabaseInitializationTask
+            classname="org.eclipse.osee.framework.access.provider.internal.config.FrameworkAccessConfig">
+      </DatabaseInitializationTask>
+   </extension>
+
+</plugin>
diff --git a/plugins/org.eclipse.osee.framework.access.provider/pom.xml b/plugins/org.eclipse.osee.framework.access.provider/pom.xml
new file mode 100644
index 00000000000..5a34c171f75
--- /dev/null
+++ b/plugins/org.eclipse.osee.framework.access.provider/pom.xml
@@ -0,0 +1,35 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+
+	<modelVersion>4.0.0</modelVersion>
+
+	<parent>
+		<groupId>org.eclipse.osee</groupId>
+		<artifactId>org.eclipse.osee.client.parent</artifactId>
+		<version>0.9.9-SNAPSHOT</version>
+		<relativePath>../../plugins/org.eclipse.osee.client.parent</relativePath>
+	</parent>
+
+	<artifactId>org.eclipse.osee.framework.access.provider</artifactId>
+	<packaging>eclipse-plugin</packaging>
+	<name>OSEE Framework Access (Incubation)</name>
+
+   <build>
+     <!-- workaround for https://issues.sonatype.org/browse/TYCHO-168 -->
+     <resources>
+      <resource>
+        <directory>src</directory>
+        <excludes>
+          <exclude>**/*.java</exclude>
+        </excludes>
+      </resource>
+    </resources>
+    <plugins>
+      <plugin>
+        <groupId>org.eclipse.tycho</groupId>
+        <artifactId>tycho-source-plugin</artifactId>
+      </plugin>
+    </plugins>
+  </build>
+  
+</project>
\ No newline at end of file
diff --git a/plugins/org.eclipse.osee.framework.access.provider/src/org/eclipse/osee/framework/access/provider/internal/DefaultFrameworkAccessContstants.java b/plugins/org.eclipse.osee.framework.access.provider/src/org/eclipse/osee/framework/access/provider/internal/DefaultFrameworkAccessContstants.java
new file mode 100644
index 00000000000..1d5654fa44e
--- /dev/null
+++ b/plugins/org.eclipse.osee.framework.access.provider/src/org/eclipse/osee/framework/access/provider/internal/DefaultFrameworkAccessContstants.java
@@ -0,0 +1,30 @@
+/*******************************************************************************
+ * Copyright (c) 2012 Boeing.
+ * All rights reserved. This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License v1.0
+ * which accompanies this distribution, and is available at
+ * http://www.eclipse.org/legal/epl-v10.html
+ *
+ * Contributors:
+ *     Boeing - initial API and implementation
+ *******************************************************************************/
+package org.eclipse.osee.framework.access.provider.internal;
+
+import org.eclipse.osee.framework.core.data.IAccessContextId;
+import org.eclipse.osee.framework.core.data.TokenFactory;
+
+/**
+ * @author John Misinco
+ */
+public final class DefaultFrameworkAccessContstants {
+
+   private DefaultFrameworkAccessContstants() {
+      //do nothing
+   }
+
+   public static final IAccessContextId DEFAULT_FRAMEWORK_CONTEXT = TokenFactory.createAccessContextId(
+      "AeA3J6AvwgEG4HGsypAA", "guest.context");
+
+   public static final String STORAGE_ARTIFACT_NAME = "Framework Access Model";
+
+}
diff --git a/plugins/org.eclipse.osee.framework.access.provider/src/org/eclipse/osee/framework/access/provider/internal/FrameworkAccessControl.java b/plugins/org.eclipse.osee.framework.access.provider/src/org/eclipse/osee/framework/access/provider/internal/FrameworkAccessControl.java
new file mode 100644
index 00000000000..0287dd47c8c
--- /dev/null
+++ b/plugins/org.eclipse.osee.framework.access.provider/src/org/eclipse/osee/framework/access/provider/internal/FrameworkAccessControl.java
@@ -0,0 +1,40 @@
+/*******************************************************************************
+ * Copyright (c) 2012 Boeing.
+ * All rights reserved. This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License v1.0
+ * which accompanies this distribution, and is available at
+ * http://www.eclipse.org/legal/epl-v10.html
+ *
+ * Contributors:
+ *     Boeing - initial API and implementation
+ *******************************************************************************/
+package org.eclipse.osee.framework.access.provider.internal;
+
+import java.util.Collection;
+import org.eclipse.osee.framework.core.data.IAccessContextId;
+import org.eclipse.osee.framework.core.dsl.integration.RoleContextProvider;
+import org.eclipse.osee.framework.core.model.IBasicArtifact;
+import org.eclipse.osee.framework.core.services.CmAccessControl;
+
+/**
+ * @author John Misinco
+ */
+public class FrameworkAccessControl implements CmAccessControl {
+
+   private final RoleContextProvider roleContextProvider;
+
+   public FrameworkAccessControl(RoleContextProvider roleContextProvider) {
+      this.roleContextProvider = roleContextProvider;
+   }
+
+   @Override
+   public boolean isApplicable(IBasicArtifact<?> user, Object object) {
+      return true;
+   }
+
+   @Override
+   public Collection<? extends IAccessContextId> getContextId(IBasicArtifact<?> user, Object object) {
+      return roleContextProvider.getContextId(user);
+   }
+
+}
diff --git a/plugins/org.eclipse.osee.framework.access.provider/src/org/eclipse/osee/framework/access/provider/internal/FrameworkAccessControlProxy.java b/plugins/org.eclipse.osee.framework.access.provider/src/org/eclipse/osee/framework/access/provider/internal/FrameworkAccessControlProxy.java
new file mode 100644
index 00000000000..294991ddeb0
--- /dev/null
+++ b/plugins/org.eclipse.osee.framework.access.provider/src/org/eclipse/osee/framework/access/provider/internal/FrameworkAccessControlProxy.java
@@ -0,0 +1,74 @@
+/*******************************************************************************
+ * Copyright (c) 2012 Boeing.
+ * All rights reserved. This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License v1.0
+ * which accompanies this distribution, and is available at
+ * http://www.eclipse.org/legal/epl-v10.html
+ *
+ * Contributors:
+ *     Boeing - initial API and implementation
+ *******************************************************************************/
+package org.eclipse.osee.framework.access.provider.internal;
+
+import java.util.Collection;
+import org.eclipse.osee.framework.core.data.IAccessContextId;
+import org.eclipse.osee.framework.core.dsl.integration.AccessModelInterpreter;
+import org.eclipse.osee.framework.core.dsl.integration.OseeDslAccessModel;
+import org.eclipse.osee.framework.core.dsl.integration.OseeDslProvider;
+import org.eclipse.osee.framework.core.dsl.integration.RoleContextProvider;
+import org.eclipse.osee.framework.core.dsl.ui.integration.operations.OseeDslRoleContextProvider;
+import org.eclipse.osee.framework.core.exception.OseeCoreException;
+import org.eclipse.osee.framework.core.model.IBasicArtifact;
+import org.eclipse.osee.framework.core.model.access.AccessModel;
+import org.eclipse.osee.framework.core.model.access.HasAccessModel;
+import org.eclipse.osee.framework.core.services.CmAccessControl;
+import org.eclipse.osee.framework.core.util.Conditions;
+
+/**
+ * @author John Misinco
+ */
+public class FrameworkAccessControlProxy implements CmAccessControl, HasAccessModel {
+
+   private AccessModelInterpreter interpreter;
+   private CmAccessControl frameworkAccessControl;
+   private AccessModel accessModel;
+
+   public void setAccessModelInterpreter(AccessModelInterpreter interpreter) {
+      this.interpreter = interpreter;
+   }
+
+   public void start() {
+      OseeDslProvider frameworkDslProvider = new FrameworkDslProvider("osee:/xtext/framework.access.osee");
+      RoleContextProvider roleProvider = new OseeDslRoleContextProvider(frameworkDslProvider);
+
+      accessModel = new OseeDslAccessModel(interpreter, frameworkDslProvider);
+      frameworkAccessControl = new FrameworkAccessControl(roleProvider);
+   }
+
+   public void stop() {
+      frameworkAccessControl = null;
+      accessModel = null;
+   }
+
+   private void checkInitialized() throws OseeCoreException {
+      Conditions.checkNotNull(frameworkAccessControl, "frameworkAccess",
+         "FrameworkAccessControlService not properly initialized");
+   }
+
+   @Override
+   public AccessModel getAccessModel() {
+      return accessModel;
+   }
+
+   @Override
+   public boolean isApplicable(IBasicArtifact<?> user, Object object) {
+      return frameworkAccessControl.isApplicable(user, object);
+   }
+
+   @Override
+   public Collection<? extends IAccessContextId> getContextId(IBasicArtifact<?> user, Object object) throws OseeCoreException {
+      checkInitialized();
+      return frameworkAccessControl.getContextId(user, object);
+   }
+
+}
diff --git a/plugins/org.eclipse.osee.framework.access.provider/src/org/eclipse/osee/framework/access/provider/internal/FrameworkDslProvider.java b/plugins/org.eclipse.osee.framework.access.provider/src/org/eclipse/osee/framework/access/provider/internal/FrameworkDslProvider.java
new file mode 100644
index 00000000000..fa1d072198a
--- /dev/null
+++ b/plugins/org.eclipse.osee.framework.access.provider/src/org/eclipse/osee/framework/access/provider/internal/FrameworkDslProvider.java
@@ -0,0 +1,88 @@
+/*******************************************************************************
+ * Copyright (c) 2012 Boeing.
+ * All rights reserved. This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License v1.0
+ * which accompanies this distribution, and is available at
+ * http://www.eclipse.org/legal/epl-v10.html
+ *
+ * Contributors:
+ *     Boeing - initial API and implementation
+ *******************************************************************************/
+package org.eclipse.osee.framework.access.provider.internal;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.logging.Level;
+import org.eclipse.osee.framework.core.dsl.ui.integration.operations.AbstractOseeDslProvider;
+import org.eclipse.osee.framework.core.enums.CoreArtifactTypes;
+import org.eclipse.osee.framework.core.enums.CoreAttributeTypes;
+import org.eclipse.osee.framework.core.exception.OseeCoreException;
+import org.eclipse.osee.framework.jdk.core.util.Strings;
+import org.eclipse.osee.framework.logging.OseeLog;
+import org.eclipse.osee.framework.skynet.core.artifact.Artifact;
+import org.eclipse.osee.framework.skynet.core.artifact.BranchManager;
+import org.eclipse.osee.framework.skynet.core.artifact.search.ArtifactQuery;
+import org.eclipse.osee.framework.skynet.core.event.OseeEventManager;
+import org.eclipse.osee.framework.skynet.core.event.filter.ArtifactEventFilter;
+import org.eclipse.osee.framework.skynet.core.event.filter.IEventFilter;
+import org.eclipse.osee.framework.skynet.core.event.listener.IArtifactEventListener;
+import org.eclipse.osee.framework.skynet.core.event.model.ArtifactEvent;
+import org.eclipse.osee.framework.skynet.core.event.model.Sender;
+
+/**
+ * @author John Misinco
+ */
+public class FrameworkDslProvider extends AbstractOseeDslProvider {
+
+   public FrameworkDslProvider(String locationUri) {
+      super(locationUri);
+      OseeEventManager.addListener(new IArtifactEventListener() {
+
+         private final List<? extends IEventFilter> filter =
+            Arrays.asList(new ArtifactEventFilter(getStorageArtifact()));
+
+         @Override
+         public List<? extends IEventFilter> getEventFilters() {
+            return filter;
+         }
+
+         @Override
+         public void handleArtifactEvent(ArtifactEvent artifactEvent, Sender sender) {
+            try {
+               loadDsl();
+            } catch (OseeCoreException ex) {
+               OseeLog.log(FrameworkDslProvider.class, Level.SEVERE, ex);
+            }
+         }
+      });
+   }
+
+   private Artifact getStorageArtifact() {
+      try {
+         return ArtifactQuery.getArtifactFromTypeAndName(CoreArtifactTypes.AccessControlModel,
+            DefaultFrameworkAccessContstants.STORAGE_ARTIFACT_NAME, BranchManager.getCommonBranch());
+      } catch (OseeCoreException ex) {
+         return null;
+      }
+   }
+
+   @Override
+   protected String getModelFromStorage() throws OseeCoreException {
+      Artifact storageArtifact = getStorageArtifact();
+      if (storageArtifact != null) {
+         return storageArtifact.getSoleAttributeValue(CoreAttributeTypes.GeneralStringData);
+      } else {
+         return Strings.EMPTY_STRING;
+      }
+   }
+
+   @Override
+   protected void saveModelToStorage(String model) throws OseeCoreException {
+      Artifact artifact = getStorageArtifact();
+      if (artifact != null) {
+         artifact.setSoleAttributeFromString(CoreAttributeTypes.GeneralStringData, model);
+         artifact.persist(getClass().getSimpleName());
+      }
+   }
+
+}
diff --git a/plugins/org.eclipse.osee.framework.access.provider/src/org/eclipse/osee/framework/access/provider/internal/config/FrameworkAccessConfig.java b/plugins/org.eclipse.osee.framework.access.provider/src/org/eclipse/osee/framework/access/provider/internal/config/FrameworkAccessConfig.java
new file mode 100644
index 00000000000..2cef0363e5f
--- /dev/null
+++ b/plugins/org.eclipse.osee.framework.access.provider/src/org/eclipse/osee/framework/access/provider/internal/config/FrameworkAccessConfig.java
@@ -0,0 +1,66 @@
+/*******************************************************************************
+ * Copyright (c) 2012 Boeing.
+ * All rights reserved. This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License v1.0
+ * which accompanies this distribution, and is available at
+ * http://www.eclipse.org/legal/epl-v10.html
+ *
+ * Contributors:
+ *     Boeing - initial API and implementation
+ *******************************************************************************/
+package org.eclipse.osee.framework.access.provider.internal.config;
+
+import java.io.BufferedInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.URL;
+import org.eclipse.osee.framework.access.provider.internal.DefaultFrameworkAccessContstants;
+import org.eclipse.osee.framework.core.enums.CoreArtifactTypes;
+import org.eclipse.osee.framework.core.enums.CoreAttributeTypes;
+import org.eclipse.osee.framework.core.enums.CoreBranches;
+import org.eclipse.osee.framework.core.exception.OseeCoreException;
+import org.eclipse.osee.framework.core.exception.OseeExceptions;
+import org.eclipse.osee.framework.database.init.IDbInitializationTask;
+import org.eclipse.osee.framework.jdk.core.util.Lib;
+import org.eclipse.osee.framework.skynet.core.artifact.Artifact;
+import org.eclipse.osee.framework.skynet.core.artifact.ArtifactTypeManager;
+import org.eclipse.osee.framework.skynet.core.transaction.SkynetTransaction;
+import org.eclipse.osee.framework.skynet.core.transaction.TransactionManager;
+import org.osgi.framework.Bundle;
+import org.osgi.framework.FrameworkUtil;
+
+/**
+ * @author John Misinco
+ */
+public class FrameworkAccessConfig implements IDbInitializationTask {
+
+   @Override
+   public void run() throws OseeCoreException {
+      importFrameworkAccessModel();
+   }
+
+   private static void importFrameworkAccessModel() throws OseeCoreException {
+      Bundle bundle = FrameworkUtil.getBundle(FrameworkAccessConfig.class);
+      URL url = bundle.getEntry("/support/OseeAccess_FrameworkAccess.osee");
+
+      InputStream inputStream = null;
+      try {
+         inputStream = new BufferedInputStream(url.openStream());
+         SkynetTransaction transaction =
+            TransactionManager.createTransaction(CoreBranches.COMMON, "Add Framework Access Model");
+         Artifact artifact = ArtifactTypeManager.addArtifact(CoreArtifactTypes.AccessControlModel, CoreBranches.COMMON);
+         artifact.setName(DefaultFrameworkAccessContstants.STORAGE_ARTIFACT_NAME);
+         artifact.setSoleAttributeFromStream(CoreAttributeTypes.GeneralStringData, inputStream);
+         artifact.persist(transaction);
+
+         //         Artifact atsConfigFolder = AtsUtilCore.getFromToken(AtsArtifactToken.ConfigFolder);
+         //         atsConfigFolder.addChild(artifact);
+         //         atsConfigFolder.persist(transaction);
+         transaction.execute();
+      } catch (IOException ex) {
+         OseeExceptions.wrapAndThrow(ex);
+      } finally {
+         Lib.close(inputStream);
+      }
+   }
+}
diff --git a/plugins/org.eclipse.osee.framework.access.provider/support/OseeAccess_FrameworkAccess.osee b/plugins/org.eclipse.osee.framework.access.provider/support/OseeAccess_FrameworkAccess.osee
new file mode 100644
index 00000000000..f6149cf6309
--- /dev/null
+++ b/plugins/org.eclipse.osee.framework.access.provider/support/OseeAccess_FrameworkAccess.osee
@@ -0,0 +1,21 @@
+
+/*
+ * This defines the framework level access control.  Roles are created and
+ * can extend each one another.  Multiple guid's can be listed in each role
+ * definition representing either an individual user guid, or group guid.
+ * A role can specify 1 or more accessContexts that are applicable to the
+ * guid(s) listed.
+ * 
+ */
+
+
+role "Guest" {
+	guid "AAABDi35uzwAxJLISLBZdA";
+	accessContext "guest.context";
+}
+
+accessContext "guest.context" {
+	guid "AeA3J6AvwgEG4HGsypAA";
+	DENY edit artifactType "Artifact";
+	DENY edit relationType ALL BOTH;
+}
diff --git a/plugins/org.eclipse.osee.framework.access.test/src/org/eclipse/osee/framework/access/test/mocks/MockConfigurationManagementProvider.java b/plugins/org.eclipse.osee.framework.access.test/src/org/eclipse/osee/framework/access/test/mocks/MockConfigurationManagementProvider.java
index d8c184b8ed7..66c3be1381b 100644
--- a/plugins/org.eclipse.osee.framework.access.test/src/org/eclipse/osee/framework/access/test/mocks/MockConfigurationManagementProvider.java
+++ b/plugins/org.eclipse.osee.framework.access.test/src/org/eclipse/osee/framework/access/test/mocks/MockConfigurationManagementProvider.java
@@ -42,4 +42,9 @@ public class MockConfigurationManagementProvider implements CmAccessControlProvi
    public boolean wasGetCMCalled() {
       return wasGetCMCalled;
    }
+
+   @Override
+   public void setDefaultAccessControl(CmAccessControl defaultAccessControl) {
+      //
+   }
 }
\ No newline at end of file
diff --git a/plugins/org.eclipse.osee.framework.access/src/org/eclipse/osee/framework/access/internal/AccessControlService.java b/plugins/org.eclipse.osee.framework.access/src/org/eclipse/osee/framework/access/internal/AccessControlService.java
index 4bbffaf02f1..1a04b349271 100644
--- a/plugins/org.eclipse.osee.framework.access/src/org/eclipse/osee/framework/access/internal/AccessControlService.java
+++ b/plugins/org.eclipse.osee.framework.access/src/org/eclipse/osee/framework/access/internal/AccessControlService.java
@@ -52,7 +52,7 @@ import org.eclipse.osee.framework.database.IOseeDatabaseService;
 import org.eclipse.osee.framework.database.core.IOseeStatement;
 import org.eclipse.osee.framework.jdk.core.type.DoubleKeyHashMap;
 import org.eclipse.osee.framework.jdk.core.type.HashCollection;
-import org.eclipse.osee.framework.jdk.core.type.Pair;
+import org.eclipse.osee.framework.jdk.core.util.GUID;
 import org.eclipse.osee.framework.lifecycle.AbstractLifecycleVisitor;
 import org.eclipse.osee.framework.lifecycle.ILifecycleService;
 import org.eclipse.osee.framework.logging.OseeLog;
@@ -62,6 +62,7 @@ import org.eclipse.osee.framework.skynet.core.artifact.Artifact;
 import org.eclipse.osee.framework.skynet.core.artifact.BranchManager;
 import org.eclipse.osee.framework.skynet.core.artifact.search.ArtifactQuery;
 import org.eclipse.osee.framework.skynet.core.event.OseeEventManager;
+import org.eclipse.osee.framework.skynet.core.event.filter.ArtifactEventFilter;
 import org.eclipse.osee.framework.skynet.core.event.filter.ArtifactTypeEventFilter;
 import org.eclipse.osee.framework.skynet.core.event.filter.BranchGuidEventFilter;
 import org.eclipse.osee.framework.skynet.core.event.filter.IEventFilter;
@@ -114,12 +115,13 @@ public class AccessControlService implements IAccessControlService {
    private final Map<Integer, Integer> lockedObjectToSubject = new HashMap<Integer, Integer>(); // subject, permission
    private final HashCollection<Integer, PermissionEnum> subjectToPermissionCache =
       new HashCollection<Integer, PermissionEnum>(true);
-   private final Map<Pair<IBasicArtifact<?>, Collection<?>>, AccessDataQuery> accessDataCache =
+   private final Map<Collection<String>, AccessDataQuery> accessDataCache =
       new MapMaker().expiration(1, TimeUnit.HOURS).makeMap();;
 
    private final IOseeCachingService cachingService;
    private final IOseeDatabaseService databaseService;
    private final IdentityService identityService;
+   private AccessControlUpdateListener eventListener;
 
    public AccessControlService(IOseeDatabaseService databaseService, IOseeCachingService cachingService, IdentityService identityService) {
       super();
@@ -279,7 +281,6 @@ public class AccessControlService implements IAccessControlService {
    @Override
    public boolean hasPermission(Object object, PermissionEnum permission) throws OseeCoreException {
       boolean result = true;
-      // System.out.println(String.format("hasPermission: obj [%s] request [%s]", object, permission));
       Collection<?> objectsToCheck = null;
       if (object instanceof Collection<?>) {
          objectsToCheck = (Collection<?>) object;
@@ -290,16 +291,28 @@ public class AccessControlService implements IAccessControlService {
       }
       IBasicArtifact<?> subject = UserManager.getUser();
       AccessDataQuery accessQuery = getAccessData(subject, objectsToCheck);
-      // System.out.println(String.format("hasPermission: accessQuery [%s]", accessQuery));
       result = accessQuery.matchesAll(permission);
-      // System.out.println(String.format("hasPermission: result [%s]", result));
       return result;
    }
 
    @Override
    public AccessDataQuery getAccessData(IBasicArtifact<?> userArtifact, Collection<?> objectsToCheck) throws OseeCoreException {
-      Pair<IBasicArtifact<?>, Collection<?>> key =
-         new Pair<IBasicArtifact<?>, Collection<?>>(userArtifact, objectsToCheck);
+      List<String> key = new LinkedList<String>();
+      for (Object o : objectsToCheck) {
+         if (o instanceof Branch) {
+            key.add(((Branch) o).getGuid());
+         } else if (o instanceof Artifact) {
+            key.add(((Artifact) o).getGuid() + ((Artifact) o).getBranchGuid());
+         } else {
+            key.add(GUID.create());
+         }
+      }
+
+      if (eventListener == null) {
+         eventListener = new AccessControlUpdateListener((Artifact) userArtifact.getFullArtifact());
+         OseeEventManager.addListener(eventListener);
+      }
+
       if (!accessDataCache.containsKey(key)) {
          ILifecycleService service = getLifecycleService();
          AccessData accessData = new AccessData();
@@ -695,13 +708,18 @@ public class AccessControlService implements IAccessControlService {
 
    private final class AccessControlUpdateListener implements IArtifactEventListener {
 
-      //@formatter:off
-      private final List<? extends IEventFilter> eventFilters =
-         Arrays.asList(
-            new ArtifactTypeEventFilter(CoreArtifactTypes.AccessControlModel),
-            new BranchGuidEventFilter(CoreBranches.COMMON)
-            );
-      //@formatter:on
+      private final List<? extends IEventFilter> eventFilters;
+
+      public AccessControlUpdateListener() {
+         eventFilters =
+            Arrays.asList(new ArtifactTypeEventFilter(CoreArtifactTypes.AccessControlModel), new BranchGuidEventFilter(
+               CoreBranches.COMMON));
+      }
+
+      public AccessControlUpdateListener(Artifact artifact) {
+         eventFilters =
+            Arrays.asList(new ArtifactEventFilter(artifact), new BranchGuidEventFilter(artifact.getBranch()));
+      }
 
       @Override
       public List<? extends IEventFilter> getEventFilters() {
diff --git a/plugins/org.eclipse.osee.framework.access/src/org/eclipse/osee/framework/access/internal/AccessControlServiceProxy.java b/plugins/org.eclipse.osee.framework.access/src/org/eclipse/osee/framework/access/internal/AccessControlServiceProxy.java
index c50e4b7f5dc..859e7f7ddf1 100644
--- a/plugins/org.eclipse.osee.framework.access/src/org/eclipse/osee/framework/access/internal/AccessControlServiceProxy.java
+++ b/plugins/org.eclipse.osee.framework.access/src/org/eclipse/osee/framework/access/internal/AccessControlServiceProxy.java
@@ -89,4 +89,4 @@ public final class AccessControlServiceProxy implements IAccessControlService {
       checkInitialized();
       return getProxiedObject().getAccessData(userArtifact, itemsToCheck);
    }
-}
+}
\ No newline at end of file
diff --git a/plugins/org.eclipse.osee.framework.access/src/org/eclipse/osee/framework/access/internal/cm/CmAccessControlProviderImpl.java b/plugins/org.eclipse.osee.framework.access/src/org/eclipse/osee/framework/access/internal/cm/CmAccessControlProviderImpl.java
index 421ad117d0b..72701d355ec 100644
--- a/plugins/org.eclipse.osee.framework.access/src/org/eclipse/osee/framework/access/internal/cm/CmAccessControlProviderImpl.java
+++ b/plugins/org.eclipse.osee.framework.access/src/org/eclipse/osee/framework/access/internal/cm/CmAccessControlProviderImpl.java
@@ -25,11 +25,21 @@ import org.eclipse.osee.framework.core.services.HasCmAccessControl;
 public class CmAccessControlProviderImpl implements CmAccessControlProvider {
 
    private final Collection<CmAccessControl> cmServices;
+   private CmAccessControl defaultAccessControl;
 
    public CmAccessControlProviderImpl(Collection<CmAccessControl> cmServices) {
       this.cmServices = cmServices;
    }
 
+   public CmAccessControl getDefaultAccessControl() {
+      return defaultAccessControl;
+   }
+
+   @Override
+   public void setDefaultAccessControl(CmAccessControl defaultAccessControl) {
+      this.defaultAccessControl = defaultAccessControl;
+   }
+
    @Override
    public CmAccessControl getService(IBasicArtifact<?> userArtifact, Object object) throws OseeCoreException {
       if (object instanceof HasCmAccessControl) {
@@ -44,7 +54,7 @@ public class CmAccessControlProviderImpl implements CmAccessControlProvider {
             }
          }
          if (applicableCms.isEmpty()) {
-            cmToReturn = null;
+            cmToReturn = getDefaultAccessControl();
          } else if (applicableCms.size() == 1) {
             cmToReturn = applicableCms.iterator().next();
          } else {
diff --git a/plugins/org.eclipse.osee.framework.access/src/org/eclipse/osee/framework/access/internal/cm/CmAccessProviderProxy.java b/plugins/org.eclipse.osee.framework.access/src/org/eclipse/osee/framework/access/internal/cm/CmAccessProviderProxy.java
index c2d68cdd46e..6645429d0d9 100644
--- a/plugins/org.eclipse.osee.framework.access/src/org/eclipse/osee/framework/access/internal/cm/CmAccessProviderProxy.java
+++ b/plugins/org.eclipse.osee.framework.access/src/org/eclipse/osee/framework/access/internal/cm/CmAccessProviderProxy.java
@@ -11,6 +11,7 @@
 package org.eclipse.osee.framework.access.internal.cm;
 
 import java.util.Collection;
+import java.util.Map;
 import java.util.concurrent.CopyOnWriteArraySet;
 import org.eclipse.osee.framework.access.IAccessProvider;
 import org.eclipse.osee.framework.access.internal.AccessControlServiceProxy;
@@ -31,27 +32,49 @@ public final class CmAccessProviderProxy implements IAccessProvider {
    private IAccessProvider accessProvider;
    private IAccessControlService accessControlService;
 
+   private final CmAccessControlProvider cmProvider;
+
+   public CmAccessProviderProxy() {
+      super();
+      cmProvider = new CmAccessControlProviderImpl(cmServices);
+   }
+
    public void setAccessControlService(IAccessControlService accessControlService) {
       this.accessControlService = accessControlService;
    }
 
-   public void addCmAccessControl(CmAccessControl cmAccessControl) {
-      cmServices.add(cmAccessControl);
+   public void addCmAccessControl(CmAccessControl cmAccessControl, Map<String, Object> properties) {
+      if (isDefault(properties)) {
+         cmProvider.setDefaultAccessControl(cmAccessControl);
+      } else {
+         cmServices.add(cmAccessControl);
+      }
       refreshCache();
    }
 
-   public void removeCmAccessControl(CmAccessControl cmAccessControl) {
-      cmServices.remove(cmAccessControl);
+   public void removeCmAccessControl(CmAccessControl cmAccessControl, Map<String, Object> properties) {
+      if (isDefault(properties)) {
+         cmProvider.setDefaultAccessControl(null);
+      } else {
+         cmServices.remove(cmAccessControl);
+      }
       refreshCache();
    }
 
+   private boolean isDefault(Map<String, Object> properties) {
+      if (properties.containsKey("default")) {
+         return (Boolean) properties.get("default");
+      }
+      return false;
+   }
+
    public void start() {
-      CmAccessControlProvider cmProvider = new CmAccessControlProviderImpl(cmServices);
       accessProvider = new CmAccessProvider(cmProvider);
    }
 
    public void stop() {
       accessProvider = null;
+      cmProvider.setDefaultAccessControl(null);
       cmServices.clear();
    }
 
diff --git a/plugins/org.eclipse.osee.framework.core.model/src/org/eclipse/osee/framework/core/services/CmAccessControlProvider.java b/plugins/org.eclipse.osee.framework.core.model/src/org/eclipse/osee/framework/core/services/CmAccessControlProvider.java
index a9f276c2b0c..bd800a4d3ca 100644
--- a/plugins/org.eclipse.osee.framework.core.model/src/org/eclipse/osee/framework/core/services/CmAccessControlProvider.java
+++ b/plugins/org.eclipse.osee.framework.core.model/src/org/eclipse/osee/framework/core/services/CmAccessControlProvider.java
@@ -19,4 +19,6 @@ import org.eclipse.osee.framework.core.model.IBasicArtifact;
 public interface CmAccessControlProvider {
 
    CmAccessControl getService(IBasicArtifact<?> user, Object object) throws OseeCoreException;
+
+   void setDefaultAccessControl(CmAccessControl defaultAccessControl);
 }
diff --git a/plugins/org.eclipse.osee.framework.skynet.core/src/org/eclipse/osee/framework/skynet/core/event/filter/ArtifactEventFilter.java b/plugins/org.eclipse.osee.framework.skynet.core/src/org/eclipse/osee/framework/skynet/core/event/filter/ArtifactEventFilter.java
new file mode 100644
index 00000000000..f46af52313a
--- /dev/null
+++ b/plugins/org.eclipse.osee.framework.skynet.core/src/org/eclipse/osee/framework/skynet/core/event/filter/ArtifactEventFilter.java
@@ -0,0 +1,56 @@
+/*******************************************************************************
+ * Copyright (c) 2012 Boeing.
+ * All rights reserved. This program and the accompanying materials
+ * are made available under the terms of the Eclipse Public License v1.0
+ * which accompanies this distribution, and is available at
+ * http://www.eclipse.org/legal/epl-v10.html
+ *
+ * Contributors:
+ *     Boeing - initial API and implementation
+ *******************************************************************************/
+package org.eclipse.osee.framework.skynet.core.event.filter;
+
+import java.util.Arrays;
+import java.util.List;
+import org.eclipse.osee.framework.core.model.event.IBasicGuidArtifact;
+import org.eclipse.osee.framework.core.model.event.IBasicGuidRelation;
+import org.eclipse.osee.framework.skynet.core.artifact.Artifact;
+
+/**
+ * @author John Misinco
+ */
+public class ArtifactEventFilter implements IEventFilter {
+
+   private final Artifact filterArtifact;
+
+   public ArtifactEventFilter(Artifact artifact) {
+      this.filterArtifact = artifact;
+   }
+
+   @Override
+   public boolean isMatch(String branchGuid) {
+      return branchGuid.equals(filterArtifact.getBranchGuid());
+   }
+
+   @Override
+   public boolean isMatchArtifacts(List<? extends IBasicGuidArtifact> guidArts) {
+      for (IBasicGuidArtifact art : guidArts) {
+         if (art.getGuid().equals(filterArtifact.getGuid()) && art.getBranchGuid().equals(
+            filterArtifact.getBranchGuid())) {
+            return true;
+         }
+      }
+      return false;
+   }
+
+   @Override
+   public boolean isMatchRelationArtifacts(List<? extends IBasicGuidRelation> relations) {
+      for (IBasicGuidRelation relation : relations) {
+         if (isMatchArtifacts(Arrays.asList(relation.getArtA(), relation.getArtB()))) {
+            return true;
+         }
+      }
+      return false;
+   }
+
+}