I have an Appian Security Design question. I have designed a Contract Request Ap

RE: I have an Appian Security Design question. I have designed a Contract Request Ap

Andrew P Gramann — Fri, 03 Jul 2015 03:05:12 GMT

Perhaps should all app users be allowed to view the Record and then put security on each Process Instance resulting in them only being able to their Records their allowed?

This is the way to do it for process backed records. Additionally, a!queryRecord() takes security into account when it is executed, so your can develop reports against your records type that still respect record level security.

Appian COE has written up the best practice for record level security on Data Entity backed records here forum.appian.com/.../Record_Level_Security_for_Entity_Backed_Records_Best_Practice.html

RE: I have an Appian Security Design question. I have designed a Contract Request Ap

nathan.schmitz — Fri, 03 Jul 2015 03:01:13 GMT

Having per instance process security using process backed records is probably the simplest approach. However processes must be archived at some point (preferably soon) after completion at which point the process will no longer be visible. If this is unacceptable, you should consider using entity backed records and implementing security as part of the default filter. This will enables users to continue to see the record even after process instances are archived.

RE: I have an Appian Security Design question. I have designed a Contract Request Ap

greggl — Thu, 02 Jul 2015 21:29:50 GMT

...process via the News but not all the other contract Records.

However this is not a good user experience. The documents attached to the Record, and latest data, are only visible via the Record. I am wondering if there is a better way? Perhaps should all app users be allowed to view the Record and then put security on each Process Instance resulting in them only being able to their Records their allowed?

In other words, what is the best security architecture to allow users identified at process run-time to see only the Records they are participating in the process and no other records for the same process model?

Thanks,
Gregg