Dynamically adding permissions for a Report reviewer #

A customer is using M-Files as a CRM system in their company. As the company is very meticulous about its security, specific permissions are set on Report objects in M-Files. Only the Accounting user group can have permission to view and edit such objects. The report goes through the review process. Once the document is in the review state, we need to give permissions to the M-Files user in the Document Reviewer(s) field.

When the document is created, Automatic permissions are applied. These permissions give full access rights to the user group Accounting.

Now we want to add grant permission from Document Reviewer(s) property and keep all of the previous permissions. This process is executed in the In Review state.

Once the review is done, the reviewer sends the report to the Review Finished state and, because of the automatic permissions on workflow states, the review is no longer present in the permissions list. In this way, we can dynamically give permissions to the user for one version of the object that maybe previously didn’t have permissions on the object because he is not present in the user group. This can happen if an employee is working with the Accounting department but they are not part of the Accounting department user group.

Configuration #

Because permissions are set automatically through the workflow, first we must disable the automatic permissions from the workflow state so that we can override them with permissions that are set through the property. Because of this, we have two parts in the permission set configuration. This rule will be applied when the object is changed in the state In Review of the Report Review workflow.

Dynamically overwriting document permissions for the responsible department #

When the document goes through a different process in the company, we want to remove and give permissions to the specific user groups. Let’s say that we have a bill for a product license that was created in M-Files by development. Once all of the properties are entered, development sends this document to accounting for archiving.

Configuration #