SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here's the scenario:

When a document is created within a specific document library, a workflow will be started. This workflow will require the document owner to select a number of users to be either primary agents or secondary agents for the document.

The workflow will then create fine grain permissions for that document for both the secondary and primary agents. These will be the only users able to see the document in the library.

Am I on the right track here in terms of thinking this is best achieved with implementing fine-grain permissions?

Would this be difficult to implement using a workflow created in SharePoint designer? Or would I have to implement something more custom in Visual Studio?

I thought that before I try to implement something, I should put the question out there as there is bound to be someone with more experience with this kind of thing than me.

Any advice is much appreciated.

share|improve this question
up vote 1 down vote accepted

From TechNet,

The maximum number of unique security scopes set for a list should not exceed 1,000.

A scope is the security boundary for a securable object and any of its children that do not have a separate security boundary defined. A scope contains an Access Control List (ACL), but unlike NTFS ACLs, a scope can include security principals that are specific to SharePoint Server. The members of an ACL for a scope can include Windows users, user accounts other than Windows users (such as forms-based accounts), Active Directory groups, or SharePoint groups.

If you are talking about a lot of documents or if you have a lot of agents, then this is going to be an issue. You'll need a custom workflow action to do it, there isn't a native action to break permissions and reassign them (and it would have to run under an impersonation step as users wouldn't have the ability to break and reset permissions).

If they truely need to be absolutely visible to only the listed users, then you'll probably want to use folders. The folders can be secured, you'll be less likely to hit that 1000 security scope boundary, and it'll be easier to manage.

If the information just needs to be hidden from them because it isn't relevant, then you can create a view that is filtered by primary agent is equal to [Me] or secondary agent is equal to [Me]. This will show the logged in agent all the documents assigned to them.

share|improve this answer
There is maybe an option for 1000+,…, I have not tested it myself. – Anders Aune Oct 29 '12 at 10:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.