Hi @RV-13100656-0,
I view this access stuff from two roles persepctive, let's justify the permissions first. I am going to narrow down a bit deeper for my understanding aligning with yours, so please bear with me.
Measuer Owner: Will have read, write and possibly delete permissions on Objective, Global Measure, Key Priorities and Yearly Objectives.
For Measure Owner it seems like s/he has bit broader access to view and manage KPI def. and related meta. I am assuming s/he may have permissions to assign or share records (might be not).
Conten Owner: Sufficient if create and write permissions are there where KPI's are stored, namely Global Measure table or some related/metadata(probably Objective, Key Priorities) tables. Logically you want to restrict (no write/delete permissions) for Content Owner from other table's access (Objective, Key Priorities and Yearly Objectives). What I am seeing is a clear separation of accountability for both of them. More specifically, we are going to restrict Content Owner permissions on tables that control KPI or ownership - to prevent unwanted changes. S/He is just a maker.
This is my understanding from what you described and I want to see this a table view like below for two role's permissions.
Please correct me if I am wrong.
Now comes users and ownership. As you have added Measure Owners via the user table subgrid I am not sure Content Owners have read access to user table to see relevent users (not for write/assign prevelages) at least at this point. If not please make sure Content Ownsers have read access.
As a content maker, we should reduce or remove Delete/Assign privileges on metadata table compared to Meauser Owner. Definitely, we should limit CRUD permissions on metatdata table hence it is good if we can maintain only read permissions all relevant tables (just for view purpose - if needed)
I don't have any comments on flow assigning content woner role vai AD groop - perhaps its a good and practical approach.
Now I am close to your quesiton:
Which table permissions should be changed or restricted for the Content Owner role compared to the Measure Owner
I am referring my table above - first set the permssion as needed, lowering content owner permission and highering Measure owner.
What you did for Measure Owner, you have linked measures making a many-to-many or lookup relationship via subgrid on the measure records. Essentially, this subgrid will show users from the Users table assigned as Measures Owners.
What you should do for Content Owners: You created a Content Owner security role (by copying Measure Owner) - a similar fashion (like measuer owner) need to be followed to link Content Owners with measuers (Global Measures). So this will need a custom relationship or subgrid on measure entity to link Conntent Owners(users) explicitly. So, let's create a
many-to-many [
2] or one-to-many relationship between entity and the Users table for Content Owners. So to associate a Content Owners with measuers (like Measuer Owners), a custom relationship between measures and users need to be created. To manage this link/assoication a Content Owner subgrid need to be added on the measure form - from here (subgrid) you will be able to use select Content Owners.
Please let me know if this helps.
I am sure some clues I tried to give. If these clues help to resolve the issue brought you by here, please don't forget to check the box Does this answer your question? At the same time, I am pretty sure you have liked the response!
