We have a SP Online list that users save info to via Nintex forms. The requirements are:
- the user can only view/edit items they've submitted
- the user's designated manager should be able to view, but not edit, that item (or any other item they are designated as a user's manager). The manager should not be able to view anyone's item they are not designated the manager of.
- the Site's owners should be able to view/edit any item in the list
Any number of different users throughout the organization could complete the Nintex forms and thus add entries into the list. Some users will have the same manager, some will have different managers.
Requirement 1 is easy through setting the "Create items and edit items that were created by the user" and "Read items that were created by the user" under the list's advanced settings; Requirement 3 is easy to set.
We're having issues trying to figure out how to implement requirement #2. Is this even possible? We've tried setting the user's manager permission at the item level to "read" but that still doesn't give the manager access.
Seems like the user's manager can only view the user's item if we give the manager "design" access. however, that defeats the purpose as the manager can then view/edit any other item in the list.
How can we accomplish this? Do we have to do something fancy like break inheritance with permissions and/or create a secondary list to manage permissions?