Full Control vs Read/Edit only your own

Question

I have a document library whereby in advanced settings I have selected that users can only read, and create & edit items that were created by the user. I had made the assumption (which I now believe is wrong) that this specifically related to the read, contribute and edit permission levels, as I have modified an item's permissions and granted a specific user full control, expecting the user that created the item and this specific user with full control over just this list item to be able to see it, but the user with full control cannot. To clarify further, everyone in the department has contribute access to the list to enable them to add items.

Can somebody please confirm if this is expected behaviour?

The task I'm working on is the storing of timesheets whereby a user can only create/see their own, plus the line manager, stored in a column can also see it (I have a SharePoint 2010 workflow to grant permissions to the line manager).

If this is expected behaviour I will modify the workflow and be more explicit with the removal and granting of permissions, but the simplest approach was to use the library's advanced settings to restrict read/editing access but I thought those with Full Control would not be subject to that setting.

Answer 1

I did something like this, but it was just a list so it may or may not work. I gave everyone create rights to the list. When the created an item a 2010 workflow fired off. I gathered there department info and set it to a variable. It then would look to another list that had a list of departments in one field and in a corresponding field users that where managers.It grabbed the users and pulled it into the workflow. It then gave view and edit rights to the person created the item plus their managers. You might be able to pull this off by using a required field of User account for when the item is created or uploaded and use that field to grant permissions to the user and his supervisor through workflow.

Answer 2

The "Read items created by user" and "Create and edit item created by user" settings override item-level permissions. The only I've found to allow users to view items created by someone else is to grant Manage List or Full Control over the entire list.

As you suspected, you'll need to disable the custom Read Access and Create/Edit Access settings and use an impersonation step to set permissions on individual items.