Architecture question for record management

Question

We are designing a contract management system in SharePoint 2013. The contracts are separated by departments and by locations. Users in a particular department/location should only have access to contracts in their own department/location.

We are thinking to create 1 site collection for each department - this ensures that we stay within the 200 GB content database recommendation. In each department site collection, we will have 1 document library with 1 folder for each location - permission inheritance is broken on each folder to restrict access on a location basis. We thought of 1 document library so that we can use out-of-box SharePoint views for reports across locations for executives to see.

The problem with this design is that there are about 250 different locations. This means, in each department site collection, we will have to create 250 folders in our document library and break inheritance on the 250 folders.

Another approach would be to give no one access to the document library & use a custom drop off library form to add documents. We can create a web part which elevates permissions and displays only those documents that users are supposed to see. The advantage with this approach is much less broken permission inheritance. The disadvantage is that we won't be able to use OOTB views and we'll have to implement our own search.

Thoughts appreciated!

Answer 1

You seem to have a good handle on a sensible way to organise your departments and locations but personally I wouldn't break inheritance on folders, instead I'd manage access at the Web Level simply because Webs are intended to have some independence for administration and effectively securing content seems to be the most pressing problem here.

1. Don't be afraid of creating and managing a large number of SharePoint objects as PowerShell is very much your friend here.
2. A custom Site/Web Template would seem a natural fit for the initial Site/Web creation and use of Content Type publishing combined with Information Management Policies could help with on going control.
3. Consider use of Managed Meta-Data sooner rather than later and combine it with location based defaults within Document Libraries, that way as requirements change you'll have a mechanism which may help you adapt (imagine having to write a script which would add an option to a Choice column within each Site, especially when somebody else may have already updated a particular Site's Site Column independently).
4. Reporting for Executives is now the hardest problem but either content roll-up of documents in-situ or perhaps a centralised Records Library (which is the target of a Send To connection used by SPD Workflows or a simple Information Management Policy action). To be honest it all depends on what needs to be reported. Alternatively would meta-data sent to a central list be sufficient to report on? In-place records management could help preserve source content for linking back to... it all depends on the requirements.

Answer 2

Target audience and permission are different. If you use target audience for each location, a user can still access documents from other location through the SharePoint search.