How to refine Record Level Security by specifying conditional criteria

It is possible to control the access (display, edit and delete) of users / groups to individual records based on the value in a field.

With the Security Registry entry it is possible to associate:

  1. A user / group, e.g. Trainers
  2. With a permission, e.g. Delete
  3. And a value in any field, e.g. Department=Training

With these example settings: members of the Trainers group will be able to delete any record where the value in Department=Training.

Note:

  1. The user / group can be any user or group.
  2. The permission can be Display, Edit, Delete or the special permission, Insert.
  3. Any field and value combination can be used as the condition.

See (Record Level) Security Registry entry for full details.

For example, an institution decides that while everyone should be able to view all staff records in the Parties module, only managers should be able to edit and delete staff records. We would need to ensure that:

  • Existing staff records are updated with the appropriate values:
    • Permissions are set: Display for group Everyone; and Edit and Delete for members of group Managers:

      Display onlyPermissions for Managers

      Tip: You could use the Set Record Security batch update tool to assign these Security permissions to existing records.

      -AND-

    • The Value in the Department field is set to Managers.

      Tip: The Global Replace tool could be used to batch update the value in the Department field.

      Staff records should have the following Security permissions and value in the Department field:

      Conditional security

  • As new staff records are added, the appropriate permissions and values are automatically set.

See (Record Level) Security Registry entry for details about how these security settings are configured.