Best Practice for Dynamically changing Item-Level permissions?

Question

Can you share your opinion on the best practice for Dynamically changing item permissions?

For example, given this scenario:

1. Item Creator can create an initial item.
2. After item creator creates, the item becomes read-only for him. Other users can create, but they can only see their own entries (Created by).
3. At any point in time, other users can be given Read access (or any other access) by an Administrator to a specific item.
4. The item is then given edit permission to a Reviewer and Approver. Reviewers can only edit, and Approvers can only approve.
5. After the item has been reviewed, the item becomes read-only to everyone.

I read that there is only a specific number of unique permissions for a List / Library before performance issues start to set in. Given the requirements above, it looks like item-level permission is unavoidable.

Do you have certain ideas how best to go with this?

Thank you!

Answer 1

Probably one of the best way to accomplish what you want is to create a workflow or event receiver. That may require some coding.

Also about your concern with performance, I have personally seen 10K+ items win unique permissions with no delay. The performance also can be avoided by creating views with filters.

Answer 2

You can create a custom permission level which allows users to View/Add item but not Edit/Delete. Create a group with that permission level and add all Item Creators to that group.

    SPRoleDefinition roleDefinition = new SPRoleDefinition();
                            roleDefinition.Name = "User custom permission";
                            roleDefinition.Description = "This Permission level has rights to add and view items.";
                            roleDefinition.BasePermissions = SPBasePermissions.AddListItems | SPBasePermissions.ViewListItems |
                                SPBasePermissions.ViewPages | SPBasePermissions.ViewFormPages | SPBasePermissions.OpenItems | SPBasePermissions.ViewVersions | SPBasePermissions.DeleteVersions
                                | SPBasePermissions.CreateAlerts | SPBasePermissions.BrowseDirectories | SPBasePermissions.BrowseUserInfo | SPBasePermissions.UseRemoteAPIs | SPBasePermissions.Open
                                | SPBasePermissions.EditMyUserInfo | SPBasePermissions.ManagePersonalViews | SPBasePermissions.UpdatePersonalWebParts;
web.RoleDefinitions.Add(roleDefinition);

Now they will be able to Create item but not Edit/Delete. Now you can create a view which has a filter applied "Created By =[Me]", so that creators can view only their item.

This way you can avoid item level permission.