I am developing a dynamic approval workflow for a list library. I use a combination of 2013 and 2010 workflows in a 2013 on-premise environment. The workflow has some requirements that I am trying to meet using http calls and the impersonation steps in the 2010. Here is the overview:
Workflow needs to be private - Once submitted only certain people should be able to view items
There needs to be a dynamic approval process through managers in AD
Anyone should be able to submit
I have a workflow that meets all of those requirements except for the privacy one. I can filter via views, but someone savvy with urls can just change the id in the url and navigate to the other items. I have been trying to breakInheritance and reassign the proper users manually, but that causes
HRESULT: 0x80131904 errors due to the filters. Even if someone has full access, as verified through PowerShell, they still can't access the items.
Can anyone advise on what I am doing wrong?