Access levels & Read protect

nlarson

One aspect of my app is dealing with employee job performance, an area where some privacy is needed. I've used Read Protect to create a multi-tenant app, but I am wondering if there is any way to use a Where clause to refine the visibility pool to a given user(s), not just an access level.

For a simple example Performance Warning: should be viewable to HR, The Team Manager + the subject of the warning.... i.e.

Then Read Protect from All Except HR AND MANAGER AND Users (WHERE Warnings.OwnerID=LoggedInRegularUser.EmployeeID

That's a very basic example and one I could likely work around, but I have others. If this is possible it would definitely make my life a little easier.

Thanks for any input.

tford

Then Read Protect from All Except HR AND MANAGER AND Users (WHERE Warnings.OwnerID=LoggedInRegularUser.EmployeeID

Sure, you can do this with syntax like:

IF Warnings.OwnerID=LoggedInRegularUser.EmployeeID
Then Read Protect from ....

nlarson

I think you misunderstand, I want to split the Access level based on an attribute value. Let me refine my example, since I can already work around a single user with a slightly different IF.

If Warning.OwnerID<>LoggedInRegularUser.EmployeeID
Then Read Protect from ALL Except HR and (1 of 10) Managers

The desired result is that No one should see this except, the HR team, the 1 manager, and the 1 employee. So I think my options are many access levels (1 for each manager).

However I think I just figured out a work around, need to test it but maybe this would work?

If Warning.OwnerID<>LoggedInRegularUser.EmployeeID
or
IF Warning.OwnerManagerID<>>LoggedInRegularUser.EmployeeID

Then Read Protect from ALL Except HR

tford

Maybe these 2 rules would work:

If Warning.OwnerID<>LoggedInRegularUser.EmployeeID
AND
LoggedInRegularUser.AccessLevel='Employee'
READ PROTECT Warning FROM ALL

IF Warning.OwnerManagerID<>>LoggedInRegularUser.EmployeeID
AND
LoggedInRegularUser.AccessLevel='Manager'
READ PROTECT Warning FROM ALL

Neither of these rules would be true for users with AccessLevel='HR', so HR users would be able to see everthing.

nlarson

yes, I think that will work for me. I'll give it a try. Thanks.