Restrict HRTask to Assignment Group and Parent>HR Case Assignment Group

[Jeff137]

To my understanding, there is a complex set of business rules, script includes and ACLs managing access within HRSD. I've taken a couple dives but been unable to decipher thus far. Therefore I am seeking advice on how to achieve the following requirement while minimising impact to OOB configuration.

Restrict HR Task access to members of the assignment group and/or assigned to and members of the parent HR Case assignment group.

Example:

• HRC0000001 is assigned to HRGroupA.
• HRT0000001 is assigned to HRGroupB.
• HRT0000002 is assigned to HRGroupC.
• HRT0000001 is a child of HRC0000001.
• HRT0000002 is a child of HRC0000001.
• HRGroupA and HRGroupB can access HRT0000001.
• HRGroupA and HRGroupC can access HRT0000002.
• HRGroupB cannot access HRT0000002.
• HRGroupC cannot access HRT0000001.

[Allen Andreas · Accepted solution]

Hi,

The remaining two options were ACLs and a query business rule, both of which are standard platform features. I'm unsure what type of assistance you may need for working with these, but I'll list the documentation as such:

• ACLs
• Query Business Rule

Additionally, you should be able to view other query business rules on your instance as they're used in other parts of the platform and in those records, you'll see example script, etc. Let us know if you have additional questions after you've reviewed the above and perhaps gave it a shot?

[Jeff137]

Thank you. This did lead to my solution. I ended up deactivating 2 table ACLs that granted read access to all non-ER cases. Then created a new one which has a script to grant access to the assigned to, assignment group and parent case assignment group. My testing so far has been successful. If further testing comes up good, I'll provide details in this thread.

[Allen Andreas]

Hi @Jeff137 

Great news! Yeah, in my very first reply I mentioned that you'd have to review the current ACLs as those are giving access and consider deactivating those and then creating new, etc. Glad it's all worked out so far. If anything else pops up, let us know! Take care! 🙂