Hello, I am reviewing the Modern User Interface and have discovered that some updates have been done to improve the security on files of the attachments tab (adding of the “lock” option) as explained by @katelyndwilson (Modern User Interface: Attachment checked-out). But I think that Autodesk can do more 😊. Below, a few proposed improvements to improve the security of the objects in a workspace and attachments of an object. The next proposals can be included as permissions within “Administration > Security > Roles”. Proposal 1: Include in the configuration of each workspace an option to attribute edition rights on the PLM object (attachments included) to the owner only if there is no associated workflow to this workspace. If there is a workflow, the condition script or precondition filters are used instead of this proposal. This option can be activated or not depending on the kind of the objects managed in the workspace. As of now, the conditions on the workflow are not enough because for example, a revision-controlled workspace doesn’t have a workflow and all the people who have the permissions “View Records Owned by Others” and “Edit Items” on the workspace can edit and modify the information. In our case, most of the internal employees of the company have these rights and everyone can modify the documents/items of other employees. You could argue that the users just need to change the owner of the section “Owner and Change Summary” to bypass this security but technically the administrator can manage the rights per workspace in a way that this section cannot be editable by normal users. Proposal 2: Only the owner of the PLM object can lock a file if there is no workflow associated to the workspace. Like that, depending on the workspace or the objects managed, the administrator can configure it according the business needs (activate this option or not). For workspaces with a workflow, we can imagine a different configuration to lock the attachments. For example, only people who can edit the object during the workflow can lock a file or can only lock their own file. The problem is that I see lot of drawbacks like losing the spirit of this collaboration tool. For the workspace without a workflow, you can argue that all the users can edit the attachments before a manual operation of the owner to lock the attachments, see proposal 3 to complete proposal 2. For the workspace with a workflow, you can argue that a user can create another version of a file for which he is not the owner, thus becoming the new owner of the file version attached to object. This user would then have the possibility to lock the new version of the file, as he will be the new owner. This proposal is not mature, but I am sure that Autodesk can find a good process to implement it. Proposal 3: Include an option to lock the attachments of an object directly when the working revision is created. After, only the owner of the object or the owner or the attachment file can unlock the attachments. This option can be activated or not depending on the kind of the workspace or the kind of objects being managed. Amendment for all the proposal above: Of course, the administrators can bypass these securities and turn off the option or remove the lock on a file. In the classic user interface, when an employee has checked-out a file and for example has left the company, it was not possible to do an undo checkout even for the administrators. The only way to fix it was to download the file (version checked-out) delete the file (revert the object) and upload it again. If we had 10 files in the attachments, they had to be downloaded too and uploaded again after the revert. If it was needed to keep the file history (previous versions), we are forced to download each version, revert the PLM object to restore the working version as it was just before the released, then download each version of the file to re-build the history file. This solution is quite time-consuming, and information of the different versions uploaded was lost (who did the original upload + timestamp). Therefore, I suggest having a solution available for the administrators to bypass the security. The optimal solution would be a mix of the proposals to cover all the security aspects and possible cases. Sylvain
Show More