Item Level permissions - trouble when using "Create items and edit items that were created by the user "

Question

I have a list of items that I want viewable and editable only by the item creator and one other person (the other person is set in the item data).

I created a list, and in the advanced settings set: "Create items and edit items that were created by the user" and "Read items that were created by the user" both on.

Then I created a workflow with designer that was triggered when the item was added to the list. The workflow used an impersonation step to "Add List Item Permissions" to give the other user "Read" and "Contribute". I went into "Permissions" for the list item and verfied that had "Stopped Inheriting" and that the other users permissions were set correctly.

However, when I log in as the other user, he does not have permissions to view the list item.

I'm not sure what is wrong with the approach I am trying. If there is a different way to accomplish this, I am open to other ideas as well.

Answer 1

When you set the list to "... created by user" then the item's will only be visible/editable by the creator (and Site collection admins) and there is no way you can give other persons rights to the items. These settings are restrictions on top of security.

So in order for your scenarion to work you have to turn these settings off and then have the workflow/event receiver remove all rights and add creator and specified user.

Answer 2

You can grant another person permissions to view all items in the list by granting that person Manage Lists permission on your list.

Answer 3

A user with "design" access will be able to edit view all items in the list.

However for some strange reason, even an administrator is unable to run workflow on behalf of the creator of the list item.