Workflow transition permissions

[Kasper_Arvad]

Hi, 

This might be quite a basic question, but I hope someone could help answer some questions about the "workflow transition" - "permission / Create new permission" tab.

My questions is what does it actually do, and what is best practise? When i build a new workflow I create a new permission with a name that relates to the specific workflow. But since it doesn't connect to the users permissions (group, roles, etc.) what is the thought behind it, and what is the correct way (best practise) to use it? For me right now, it kind of seems like a random drop-down menu where I'm a little in doubt about it's purpose.    

If someone could help educate a little here 😉 I would be grateful..

Kasper

[gasevsm · Accepted solution]

Creating a permission here allows you to find and select it in the Security > Roles > Permissions admin section. By analogy, adding that permission to a role Thats part of select groups lets you finetune the system as to who can/cannot perform a certain wf transition. Does this help?

[Kasper_Arvad]

Hi Martin 

Thank you for the reply, this helped quite a bit 😉 

I guess the goal is to learn everyday, and this helped me answer yet another small FLC curiosity.

Kasper

[michelle.stone]

Another resource could be an old blog post I wrote - I cover a use case where it makes sense to have multiple workflow permssions: http://underthehood-autodesk.typepad.com/blog/2014/04/tip-tuesday-deciding-who-can-do-the-work-in-pl...

Michelle

[gasevsm]

As a good practice, kindly err on the side of using and creating different wf permissions and assigning them to roles>groups to define your permission model of which user group can do what in a given workflow. I've observed situations where admins create a single generic WF Permission, assign it to all WF Transitions, and then rely on conditional scripting and custom code to do the heavy lifting.  Empirically, this latter approach although functionally sound, is inferior from perspective of system scaling and performance degradation throughout the areas that use condition scripts heavily. However, you may come across a use case where both WF permission and some specialized edge case condition script is necessary to fulfill your requirement, which is totally fine.  You may also come across a case where the list of involved people are s subsection spanning multiple admin security groups, so condition script is inevitable here. Just use best judgment and always test first.  Hope this helps,