RE: Difference in process model security and user security smart service.

Peter Lewis — Tue, 07 Jul 2020 12:51:30 GMT

These two methods provide security in different ways. It's always necessary to provide security on the process model object because this determines which users are able to start the process. Then, once a process instance is started, the instance will inherit all of the security roles provided on the process model. The Modify Process Security is used to change only a certain instance of a process, and it can be used to allow different access for different process instances.

It usually helps the most by providing an example. Suppose you have a process where any user can open a support case. Since all users should have access, you should make sure that All Users have at least initiator access on the process model to be able to start it. However, suppose that you created a process-backed record that displays data about the case. For some cases, you'd like to limit access so that only certain users can view this record. If you only use the default security provided at the process model level, all users would be able to view all cases. The Modify Process Security allows you to change an active instance of a process to change what security applies to that instance.

The Modify User Security smart service is unrelated to process security - it only updates the user rolemap and likely does not apply to this discussion.