As a preface, I work in an organization that is considered a department, which comprises several branches. In this question, branches are sub-units of the department.

I have a document library with an attached custom workflow. When an item is created or updated in this library, the workflow strips off all the permissions, then assigns proper permissions levels based on the setting of a custom field called Visibility. The choices in Visibility are:

  • Branch users (most restrictive - only allows those explicitly within the branch permissions group to see this item)
  • Department users (less restrictive - allows those explicitly included in the department and branch permissions groups to see this item; general site users still shouldn't be able to see this item)
  • All users (least restrictive - anyone with the proper credentials can see the item, whether they're explicitly in a permissions group or not)

Here are the groups and desired settings by Visibility choice:

All users

  • All Authenticated Users; [Branch] Workflow Users: View Only
  • [Department] Members: Read
  • [Branch] Members: Contribute
  • [Department] Owners; [Branch] Owners: Full Control

[Department] users

  • [Department] Members: Read
  • [Branch] Members: Contribute
  • [Department] Owners; [Branch] Owners: Full Control

[Branch] users

  • [Branch] Members: Contribute
  • [Department] Owners; [Branch] Owners: Full Control

The workflow is set up to use an impersonation step; I have site collection admin credentials. When it runs, the workflow first strips existing permissions off the current item. Then, depending on the Visibility setting, it applies the permissions structure as described above. Once finished, the permissions settings on an item set to All users looks like this:

  • All Authenticated Users: Limited Access, View Only
  • [Department] Members: Read, Limited Access
  • [Department] Owners: Full Control, Limited Access
  • [Branch] Workflow Users: View Only
  • [Branch] Members: Contribute
  • [Branch] Owners: Full Control

Here's an example, given these library contents and Visibility field settings:

Item Name (Visibility)

  • Document 1 (All users)
  • Document 2 (All users)
  • Document 3 ([Branch] users)
  • Document 4 ([Department] users)
  • Document 5 ([Department] users)

All users would be able to see Documents 1 and 2, department users would be able to see 1, 2, 4, and 5, and branch users would be able to see all five documents.

The problem I'm running into is that when an item is set to All users, items where Visibility is set to All users aren't visible to general users. I don't know at this point if there similar problems at the [Department] users level, but I suppose this problem has the potential to affect that level as well. If anyone can spot what I'm missing, I'll be happy to know what it is.

  • 1
    You aren't using draft versioning by chance? – Aboba May 8 '14 at 15:29
  • I sure am-- does that affect how visibility works? Come to think of it, with that turned on, I think I do have draft files set only to be visible to those in the Branch group. I'll try that out! – AurumPotabile May 8 '14 at 15:49
  • 1
    Go into the library settings, into visioning settings and look at the "draft item security" settings. Likely you have draft versions hidden from read-only users which is causing the problem. – Aboba May 8 '14 at 15:50
  • As soon as you mentioned draft versioning I realized what the problem was. Thank you very much for the insightful response! I'm now seeing things as I ought to. – AurumPotabile May 8 '14 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.