1

I have always given users View All and Modify All permissions because it was crucial that every employee could see all data in our org. However, we have begun using Approval Processes as sort of multi-step-workflow so that we can track our business processes, and the Modify All permission is allowing people who are not assigned a step in the process to (mostly accidentally) approve/reject a step that they should have had nothing to do with.

What is the best way to prevent users from seeing the Approve/Reject button(I assume I need to get rid of the Modify All permission) without preventing users from viewing and editing any record that they need to see?

Thanks!

EDIT: Because of the way a previous administrator implemented the system, our default sharing for several objects is 'Private'. Will changing this to Public/Read Write fix this problem? Will it create any new problems I should be aware of ahead of time?

  • Can you use a before update trigger on the approval process? check "if assigned to user"...? – Saariko Nov 5 '12 at 20:36
  • I'm not sure what you're referring to, but I don't think it gets at the question I'm asking. My question is really about sharing and permissions. Let me know if you need me to clarify something. Thanks. – jackerman09 Nov 5 '12 at 20:39
  • I know it's about sharing, but if you can't hide the approval buttons, I thought a workaround might suit. JMP – Saariko Nov 5 '12 at 20:40
  • @Saariko I don't think you can make any kind of trigger on ProcessStepInstance etc. It would have to be a field update as soon as record enters the approval just that a trigger can fire? – eyescream Nov 5 '12 at 20:46
1

How about trying :

  • If the need is only for everyone to see all data, then View All should suffice. Get rid of the Modify All (except for maybe a full System Admin)

  • Granting View All and Modify All on a per object basis rather than blanket (on a need basis, or only View All to everyone but Modify All only to those Profiles that really need that permission)

  • Create a Public Group containing all the roles and create a sharing rule per object to share all data as Public Read Only with everyone in the group. This way they can see all data but only modify what is rightfully theirs to edit. (Or as @eyescream says Sharing Rule to share everything owned by the top role and internal subordinates with top role and internal subordinates as Public Read Only)

  • No need for group? Just use "Role and (Internal) Subordinates: X" as both the owners and the "shared with whom". The X stands for a top role in the organisation and "Internal" subordinates in case Customer Portal is used. – eyescream Nov 5 '12 at 20:49
  • Implementation detail ;) A group gives you the flexibility of adding or removing roles at a future date. But yes, in theory could do without a group. Will add it as an option the answer. – techtrekker Nov 5 '12 at 20:53
  • If a user has a record shared with him, will they have the ability to Approve/Reject approval steps that are not specifically assigned to them? That is what is at the heart of my question. Thanks for the help (as usual)! – jackerman09 Nov 5 '12 at 21:03
  • If it is shared as Public Read Only (with No Modify All) then not. You can trial it for one object on a sandbox and see how it behaves. – techtrekker Nov 5 '12 at 21:06
  • I need them to be able to modify the data on any record, but not be able to approve/reject an approval process step that is not assigned to them. Do you know of any way to accomplish this goal? – jackerman09 Nov 5 '12 at 21:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.