Set fine-grain permissions through a workflow on a single document

Question

Here's the scenario:

When a document is created within a specific document library, a workflow will be started. This workflow will require the document owner to select a number of users to be either primary agents or secondary agents for the document.

The workflow will then create fine grain permissions for that document for both the secondary and primary agents. These will be the only users able to see the document in the library.

Am I on the right track here in terms of thinking this is best achieved with implementing fine-grain permissions?

Would this be difficult to implement using a workflow created in SharePoint designer? Or would I have to implement something more custom in Visual Studio?

I thought that before I try to implement something, I should put the question out there as there is bound to be someone with more experience with this kind of thing than me.

Any advice is much appreciated.

Answer 1

From TechNet,

The maximum number of unique security scopes set for a list should not exceed 1,000.

A scope is the security boundary for a securable object and any of its children that do not have a separate security boundary defined. A scope contains an Access Control List (ACL), but unlike NTFS ACLs, a scope can include security principals that are specific to SharePoint Server. The members of an ACL for a scope can include Windows users, user accounts other than Windows users (such as forms-based accounts), Active Directory groups, or SharePoint groups.

If you are talking about a lot of documents or if you have a lot of agents, then this is going to be an issue. You'll need a custom workflow action to do it, there isn't a native action to break permissions and reassign them (and it would have to run under an impersonation step as users wouldn't have the ability to break and reset permissions).

If they truely need to be absolutely visible to only the listed users, then you'll probably want to use folders. The folders can be secured, you'll be less likely to hit that 1000 security scope boundary, and it'll be easier to manage.

If the information just needs to be hidden from them because it isn't relevant, then you can create a view that is filtered by primary agent is equal to [Me] or secondary agent is equal to [Me]. This will show the logged in agent all the documents assigned to them.