Hi Everyone,
I have a requirement involving Field Encryption (KMF/Platform Encryption) on the Incident table.
- I have created a custom field and want to encrypt it using KMF/Field Encryption.
- The Incident Caller should be able to view/decrypt the encrypted field.
- The current Assigned To user should be able to view/decrypt the encrypted field.
- If the Assigned To user changes, only the new Assigned To user should be able to access the field, while the previous Assigned To user should lose access.
- In short, access should always be granted only to the current Assigned To user and the Caller of the Incident.
Since this requirement is dynamic and record-specific, a role-based Module Access Policy does not seem sufficient because roles are static.
Can this be achieved using Type = Script in a Module Access Policy? Does the policy script have access to the current record context (for example, current.assigned_to, current.caller_id, etc.) during encryption/decryption evaluation? If yes, could someone provide an example or guidance on how to implement it?
If not, what is the recommended and supported approach to achieve this requirement using KMF/Field Encryption?
Thanks in advance!
