Vault Folder ACL is not overriding lifecycle permissions

[jweiss1313]

We are running Vault Pro 2013 SP1 in full replication mode.  We have the publisher site in Easton USA and a subscriber site in Poland.  Our CAD files automatically get checked into Vault in the Engineering category that used our company release lifecycle process.  We wanted both our Poland and Easton site to use the Engineering category for their CAD files  We have some folders in Vault where our Easton site stores their CAD files and other folder where our Poland site stores their CAD files.  I created folder ACL's that I though would override the lifecycle permissions and allow the Poland site engineerings to be able to check out and edit files from their folder and the Easton engineers from their folders.

Today I discovered that our Poland engineers have been checking out and modifiying out Easton files without our knowledge.  The lifecyle process give modify and delete permissions to both engineering groups at both sites. I denied the Poland engineering group permission to modify or delete file in the ACL of the Easton site folders, but they are still able to check out our CAD files that are in the engineering category. I thought the folder ACL had the final say on whether or not you could check out files or not regardless of what permissions where given in a lifecycle process or role.

Please help me understand this so I can fix this permissions issue 

[Redmond.D]

Unfortunately, there is only 1 ACL that has control over the file at any given time.  A lifecycle ACL takes precedence over a folder ACL.  Vault does not merge these ACLs.

I don't have a good solution to your problem, but I do have an app that lets you see who has access to a given file.

[minkd · Accepted solution]

Since the ACL from the Life Cycle Definition overrides the ACL from the folder, the only way I can think of to maintain different ACLs per location is to use different life cycle definitions for Easton USA and Poland.

-Dave

[jweiss1313]

I was trying to avoid creating a seperate category and lifecycle for Poland, but it looks like I have no choice. Thank you very much for your help!  I appreciate it!

[B.Rawling]

Dave

The solution of having a seperate lifecycle for each team is not the answer when you have many different projects , My company has 20+ projects at present (Folders ACL's control the access to groups of users)and we are looking to add many more possibly will have 50+ projects before the end of the year as we move to managing more of our CAD data and other documentation in the Vault.

Having to configure and manage seperate catergories/ rules / lifecycles for each project would be impossible, The system should have a setting that disables the system ACL security (lifecycle) being applied to the Files on State change or the Folder ACL security should be able to be set to overide the State security, If the State security is not explicitly  set i.e. do not tick the allow or deny then why can't the folder security apply therefore allowing only the correct users to view/ edit / delete that data.

We have 50 licences of Vault Pro at present and are looking to role the solution out to the larger audiance in a company of 500+ , We may have to rethink the Data Mangement solution if we can not easily set the security up on our project data.Search results contain all data/ files that have the  state security applied rather than specific project data, this is just not acceptable.

This problem was identified some time ago, why hasnt a valid solution been implemented in the later 2013 / 2014 & 2015 Vault products?

Autodesk Please sort this.

Much appreciated

Bry