I've got a situation where there are strict permissions requirements on an a list of which I already have written a custom form. The requirement is that upon creation, based on metadata, only certain users have access to read and write the item.
My first attempt at this was to put this in an event receiver on the list to make sure the permissions get updated at when the item is added. I put the item in the item added event since during item adding I don't have a way to elevate privileges and get an elevated instance of the item (that I know of). This caused an unwanted delay, though short, between the time the item was created and the time the code actually ran.
The next thing I tried was to put set the item permissions in the form immediately after the item is created since I would then have an ID for the item so I can retrieve it in an elevated context (I want the item to be created under the context of the current user). This is problematic because as soon as this approach was implemented, about 50% of the time we get an error in a workflow that runs on item create saying: “Failed to start workflow. The workflow cannot access the item that is has been applied to.” (It's probably worth noting this is a Nintex workflow) - I assume the problem is due to some race condition where in the middle of the item.Update() to set the permissions, the workflow tries to start at the same time.
Ideally I would like to be able to update permissions on the very first item update (create) or during an ItemAdding event, but I am not sure how to do this without elevating the whole process such that the item is then created by the system account and not the user who actually created the item.
What options do I have available to me?