permission requirements:

  • Users from several regional departments fill out one complex InfoPath form.
  • Every user can only edit his own form instance, but he can authorize others by adding Names in specific co-worker form fields (people picker control).
  • Every User can read the form instances of his regional department
  • Every form instance can be made visible and editable to the headquarter by checking a checkbox.

Solution approaches:

  1. One library for each regional department. Co-Worker permissions were set on item level by an event handler on form save. Drawback: There must be one individual infoPath Form for each department because relative submit connections are not supported and code-behind ist not allowed.

  2. One library for all. That would require Item-Level security for both co-workers and Department-Members. Not good, too complex.

  3. Audiences? I dont know anything about it. Could it work?


  • 2
    Audiences are not suitable for permission control. They only serve to display content to a specific group. If a user manages to dig their way to the full view of the list/library, they will be able to exercise their permissions on all items.
    – teylyn
    Feb 26, 2013 at 11:39

1 Answer 1


Unfortunately, only solution 2 will satisfy your needs. Like "teylyn" said, audience targeting will only stop you from either seeing the form or not. You will have to apply security trimming based on the user's department and relevant SP group to which they belong too (assuming that's how you have it structured, each department would have their own SPGroup). You can either use Workflow (SP Designer or Nintex WF 2010) to break permissions or via code.

  • Thanks. I chose solution one, because there should be as least code as possiblöe due to cost. Solution one requires only an event handler which sets the item level permissions on save.
    – elsni
    Feb 27, 2013 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.