I have an Appian Security Design question. I have designed a Contract Request Ap

greggl over 8 years ago

I have an Appian Security Design question. I have designed a Contract Request App where security is paramount. The security requirements include 2 basic security roles:
1 - Observers allowed to view all contracts. (ex. CIO and members of contracting office group)
2 - The Requestor / process initiator and reviewers selected from form drop-downs to review can only see the requests they are a participant on.

After much review of the Security configuration options of all Appian components, I designed a solution whereby the Observers can see all the request Records and a Report of all processes and tasks. And then process participants (Initiators and Reviewers) can only see the News and when Tasks are specially assigned to them. They can not see the Record or Report. And the News postings are restricted to the participants of that process instance and the Observers group. This technically works as it allows Participants to see the current status of their ...

Discussion posts and replies are publicly visible

Parents

0 greggl over 8 years ago

...process via the News but not all the other contract Records.

However this is not a good user experience. The documents attached to the Record, and latest data, are only visible via the Record. I am wondering if there is a better way? Perhaps should all app users be allowed to view the Record and then put security on each Process Instance resulting in them only being able to their Records their allowed?

In other words, what is the best security architecture to allow users identified at process run-time to see only the Records they are participating in the process and no other records for the same process model?

Thanks,
Gregg
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 greggl over 8 years ago

...process via the News but not all the other contract Records.

However this is not a good user experience. The documents attached to the Record, and latest data, are only visible via the Record. I am wondering if there is a better way? Perhaps should all app users be allowed to view the Record and then put security on each Process Instance resulting in them only being able to their Records their allowed?

In other words, what is the best security architecture to allow users identified at process run-time to see only the Records they are participating in the process and no other records for the same process model?

Thanks,
Gregg
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data