# Role hierarchy **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [February 22, 2016, 12:47pm UTC](https://discuss.elastic.co/t/role-hierarchy/42384 "2016-02-22T12:47:08Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![aaroy428](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@aaroy428](https://discuss.elastic.co/u/aaroy428)\ **Post date:** [February 22, 2016, 12:47pm UTC](https://discuss.elastic.co/t/role-hierarchy/42384/1 "2016-02-22T12:47:08Z")
Hi everybody, I am looking to design my security model. Based on my initial assumption, I thought that because the security is based on index pattern with shield pattern expansion was done. Let me give you an example, Let say I have a company called abc, with the followings patterns. abc-_, abc-finances-_ and abc-production-_, I thought that giving someone access to the pattern abc-_ would also give access to the pattern abc-finances-\* and abc-production-_. I did some testing and it doesn't seem to be true. You can see all the indices with the pattern abc-_, but you can't use the pattern abc-finances-\* or abc-production-\* unless you have a specific grant on each of those patterns. Am I correct ? ---
**Author:** ![skearns](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skearns/32/125945_2.png) [@skearns](https://discuss.elastic.co/u/skearns)\ **Post date:** [February 22, 2016, 5:24pm UTC](https://discuss.elastic.co/t/role-hierarchy/42384/2 "2016-02-22T17:24:22Z")
Hi Alain, When you create roles in Shield, you can use wildcards in the index name, so abc-\* would expand to include any indexes that also match abc-finances-\* and abc-production-\*. Thus, if my user was assigned a role that granted read access to abc-_, when I run a search against abc-_ indexes, wildcard expansion of index names would end up also including abc-finances-\* and abc-production-\* However, you are mentioning Index Patterns, which is a Kibana-level concept. The index expansion happens at the ES level, so it should also work, if you create the index pattern with abc-\*. Hope that helps! Steve ---
**Author:** ![aaroy428](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@aaroy428](https://discuss.elastic.co/u/aaroy428)\ **Post date:** [February 23, 2016, 2:31pm UTC](https://discuss.elastic.co/t/role-hierarchy/42384/3 "2016-02-23T14:31:04Z")
Hi Steve, Thanks for your reply. My question was more along the role mamagement stand point of view. Does somebody with grant on abc-\* can also uses abc-finances-\* and abc-productions-\* without having a grant on those two indexes names specifically. I do understand that abc-\* will return all the indices includes in abc-finances-\*, but it is also less specific and will probably be slower to execute. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:46pm UTC](https://discuss.elastic.co/t/role-hierarchy/42384/4 "2017-07-06T13:46:31Z")