I need to implement list item level permission based on rules something like this:

Users can access a given list item only when they satisfy the criteria/rule of this given list item. [such as users' business group(BG) is present in the item's fields]


List Item: MyDocument1
List Fields: AllowedBG= [BG1, BG2] (this is multiple choices data type)

User A: BG=BG1
User B: BG=BG3

Here UserA can access MyDocument1 because his BG is within MyDocument1.AllowedBG,
UserB cannot access because his BG is not present in the MyDocument1.AllowedBG

Note that this is only a simplified version of my domain problem. In reality we have 3 fields in the list item to check permission for each user, so it is not possible to use User Group to manage permissions.

I can think of a workaround: (not verified)

  1. Create a customized view and edit aspx page for this list with Visual Studio
  2. In the Page_Load method (or some other methods) check user's permission (need to RunWithElevatedPrivileges)
  3. If check is successful, redirect to the original view/edit form.
  4. If check is failed, send NotAuthorizedException to users

So what is the ideal/better way of implementing such rule based item level permission in SharePoint?

3 Answers 3


Your situation is really too complex for a good answer in this setting, and there are a lot of unanswered questions as well.

Here's the simple version: lock down the library completely, and only allow users access to its contents via elevated custom code. This means you'll need to provide a custom edit screen as well (step 3 in your scenario).

Item level security is a tricky beast, and given the complexity of your situation I don't think that's a road you want to go down. This solution gives your logic complete control over who accesses what, and eliminates back-door access.

  • Thanks for your response. What do you mean by 'there are a lot of unanswered questions' ? Do I have to provide completely custom view/edit page, or is it possible to have some 'interceptor' code before opening the view/edit page? (so I can redirect to the original page after verifying)
    – Wint
    Jun 9, 2014 at 23:49
  • I meant a lot of unanswered questions in the business requirement, not the technical approach. The main concern I have is, where are the user/BG mappings stored. What happens if a user changes BGs? Not only do you have to go in and change security on all the affected documents, you have to figure out that the change happened in the first place. Jun 10, 2014 at 11:42
  • Another question is, how serious are you about security? Do you just not want Bob from Accounting to see the Marketing team's meeting agendas, or is there private and confidential data being stored? If someone URL-hacks an edit form they shouldn't be seeing (and they will), would that be a big deal? Jun 10, 2014 at 11:47

I think the best way to accomplish this is by setting up a workflow that allows you to implement that criteria.

You will find more information how to accomplish this in the following blog post How to Create a Workflow to Change Item Level Permissions

  • and every time someone changes business groups you have to change security on hundreds or perhaps thousands of documents. Jun 10, 2014 at 11:48

Use page_load function, check user permission in this function. You can't use any SharePoint feature.

  • It is really helpful if you put some code reference or links to explain your anwser
    – Waqas Sarwar MVP
    Jun 10, 2014 at 5:48
  • Yes it would be great if you could add a snippet of code to explain the idea Jun 10, 2014 at 6:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.