Advice: Structure for expense reporting

Question

How would you structure lists/libraries taking performance and security into account.

Some of the requirements connected to security:

• Users can only read reports they create, and edit before first approval phase.
• Manager (from AD), can only read and approve reports from people they are managers for.
• HR, final approval of all travel expenses forms. Read/Write all.
• A central page you can look at all your items (history).
• InfoPath Forms
• Total users approx 6000.

Tbh I’m not a big fan of the idea of breaking inheritance on several thousands of items and using item level permissions in a single list. So I’m wondering what would be a good approach to structure this without a performance close to zero when it have been used for a year.

Answer 1

I would split up into several doclibs, perhaps even seperate sites, for example per appartment.

Item level security, especially with many different ACL combinations will tank performance fast both on view and edit operations.

Also consider splitting up per year or month (content oranizer could help automate this) to avoid getting throttled (5000 items)

For the rules consider either custom Information Policies / event receivers or workflows ro solve the logic.

For rollups I would use search either filtered on meta data, content types or path.