Compose Email Functionality Limitation

[Cat Michalak]

Problem: When an HR agent needs to do a communication with any specific user, compose email functionality can be used for HR scope.
However, though the sent email is added to the activity stream only, the reply to the compose email is received in the system and is added both in the activity stream and as additional comments of the HR case. In case of HR scope, the additional comments of the HR case is visible/available to people having access to the HR case which becomes problematic, as
1. the context is lost, since the initial compose email is not added in additional comments for all users to see
2. the reply may be confidential or incomplete and not yet intended for the opened for/subject person on the case
So overall the intention with this functionality is unclear to use and we intend to make some changes.
And, in the case of HR, this visibility to all users on case can lead to compliance and/or confidential issues

Solution in mind: The main change we want to implement is to add the reply to compose email as a work-notes instead of additional comments. Since this is not available OOTB we have built a customisation.

Issue: However, the attachments which are part of the received email, are not getting restricted and continue to be visible and available to all users with access to the HR case, including the person for whom the case was raised for/ subject person.

Question: The attachments received as part of the email received are being treated separately by the platform and not necessarily by the inbound email action(s), which is causing us this issue for us in the scope and operations. We don’t want to create any configuration on global tables like sys_attachment, since this is incoming email exercise being handled. I'd like to know if there's any other solution/workaround to address this?

Thanks!

[pavani_paluri]

Hi @Cat Michalak ,

Here are my thoughts on your question:

The attachments from inbound emails are handled at the platform level
(via sys_attachment and sys_attachment_doc) and not directly controlled by the inbound email action logic.
That’s why even though we’ve customized replies to go into work notes instead of additional comments, the attachments are still showing up to all case participants.

I am thinking of a custom approach to define a rule to identify “email reply attachments” (e.g., check sys_email source or inbound action context) and build an ACL on sys_attachment scoped to HR case table that denies access to non‑HR roles when that condition is met.

Mark it helpful if this helps you to understand. Accept solution if this give you the answer you're looking for

Kind Regards,

Pavani P