Process model viewer groups

Question

Hi All, 
 My client is asking if Appian has view group for Process model instances. They needed PROD support team to view only process model instances and but not design objects. What i know so far there is no such group. 
 Can someone come across this scenario and found solution to this or is there any workaround.?

Harsha Sharma · Answer

I have a suggestion which basically involves securing the objects of application tightly so that support team can access just process model and nothing else. It goes like this - 
 
 Ensure all Support Team members are assigned the Basic User role in the Admin Console. 
 Add users to the "Designers" system group to grant access to Appian Designer. 
 Create a dedicated Application that exclusively contains the process models used within the application. 
 Create a group specifically for Support Team members. 
 Assign Viewer permissions to the Support Team group for all process models and the application. 
 Apply appropriate security configurations to all other applications/environment objects by mapping them to relevant groups so that none of the object is orphan/without any security configured. 
 
 With the above the support team member will see just one application in environment which will have process models. Apart from process models this group won't have access to any other object. The team would be able to check monitoring instances. But cannot edit them. They will not be able to see CDT/record type based process variables data as well in the instances as they won't have access to underling record or cdt.

Mike Schmitt · Answer

I feel the need to point this out - the O&M team members will ALMOST ALWAYS require full visibility into design objects - otherwise, effectively performing O&M support (including the necessary debugging, troubleshooting, and/or tracing work) will occasionally be totally impossible. 
 So the dev team CAN bend over backwards to install something complex and fairly cumbersome in terms of hoops the support team must jump through - but in my professional opinion it is NOT a good idea and it is NOT sustainable. Unless you want your O&M personnel to quit after 2 or 3 months. Your client is free to talk to me directly about this if they need further reassurance that their requirement is a bad idea.

Mike Schmitt · Answer

that will make the job of O&M support people nearly impossible, as I previously said. it is against every possible recommendation I can give you. seeing the design objects is absolutely essential to being able to debug and/or fix issues. I will gladly tell that to any customer who doesn't take your word for it.

Mike Schmitt · Answer

they don't need "full" access as in full admin access. If security groups are set up correctly (and with conscious design in advance), you can give full VIEWING access to O&M support folks without giving them ADMIN access or even EDITOR access. This would include full access to the Design side but no ability to make changes to existing objects.

Harsha Sharma · Answer

There are no groups/ ways to secure design objects with process instances this way! Being admins they will be able to see instances and objects both. Also I have never heard of a scenario like this so can you share their reason behind this ask?

Shubham Aware · Answer

You're correct - there's no built-in view-only group for process instances. Alternative, Create custom dashboards or reports to show just process instance data(Include all details) to support teams.

Stefan Helzle · Answer

While not an direct answer to your question, I typically implement support like described in this blog post: 
 appian.rocks/.../

Process model viewer groups

Top Replies