I need some help related to: Permissions

This is scenario:

  1. A new site on the platform. Purpose is to conduct approval on Items.
  2. A Request List to which 'Creation form' will create Item.
  3. Anyone can request Item for approval. A generic site collection wide SP group which contain all the members is given 'Contribute' permission on this List.
  4. Once Item is created; a workflow is triggered ( through Nintex 2013 which is the workflow engine ).
  5. The workflow consists of getting approvals from various approvers. Conditionally; the workflow may require special approval. This involves filling up a sister form and creating an item in the Special Approval List.
  6. Now, I want to restrict permissions on the Request Item such that only the current approver will be able to edit Item details. Initially; we have given 'Contribute' to all members who will be using the site.

Methods considered:

  1. Change permission once the workflow starts using 'Set Item Permissions' action such that the person who Requests cannot edit.

    Problem --> Information on the internet points out that setting Item level permissions can get messy very quickly and not a recommended solution for performance considerations.

  2. Run the workflow steps as 'Workflow Owner'. This solution involves giving the group with all the members 'Add only' permission so that they can create a request but do no edit it. Workflow actions which involves modifying the List item will be executed as Author who publishes the workflow.

    Problem --> This could potentially work. We have noticed that some Workflow tasks are created twice when it comes inside an 'Action set' that is set to execute as Author. Another thing is that we want to give the ability to Save drafts; so 'Add only' permission does not meet this.

  • We've used the run as workflow owner in many workflows and it works great. I'd say use that along with filtered views.
    – Mike
    Jul 10, 2021 at 12:42
  • thanks for your comment!
    – needtoflow
    Jul 11, 2021 at 3:13

1 Answer 1


I would go with first method you considered. Break the item permission and grant only to Owner group and the approver. Once the approval is done, kick off another workflow to switch back permission inheritance. This way the only items that will have unique item permissions are the once that are pending approval.

  • thank you! i will try it again and update here
    – needtoflow
    Jul 11, 2021 at 4:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.