2489243 - Data Inconsistency Caused by Lack of Permissions for Associated Fields

It is currently possible to create Data Inconsistencies in EC Job Information data (and anywhere else where Object Associations can be configured).

The scenario is that if the end user has permission to (for example) the Parent object field (which is required) but not the Child object field (which is also required),

meaning they do not see the Child object field, they can make a change to the Parent field and save the data with an inconsistent value in the Child object field, that is not associated with the newly selected parent value.

for example, we have a lot of fields linked between each others via assocations - in case the user is not authorized for one of 2 fields that are linked via associations

The user is able to change the field which they have permission for, which result in a data inconsistency.

Example Scenario only!!

Person Area = mandatory > can be changed by Employees( EE)

Geo-Zone is associated to Personal Area = Mandatory but Hidden.

We have a 1:n relationship between Pers Area & Geozone (custom field) - in this example it is 1:1 as it is easier to explain:

Association 1 = Pers Area > "Paris" - Geozone >"Paris"

Association 2= Pers Area> "Nizza" - Geozone >"France"

User is on Association 1> Pers Area "Paris" with Geozone "Paris"

 Steps:

1.User without permission to view/change Geozone (mandatory field), changes Pers Area from "Paris" to "Nizza" and submits workflow

2. in Workflow overview the changed Pers Area "Nizza" is displayed, but no info that geozone needs also to be changed from "Paris" to "France"

3. Approver can approve workflow although mandatory Geozone was not adjusted according to the given association from "Paris" to "France"

4. if you access User's record, inconsistent data are stored as we have now the new Pers Area and the prev. Geozone combination with "Nizza" / "Paris" instead of "Nizza" / "France"

While this is only an example, we would except in such a case at least one of the following options:

a) error message in case user submits Workflow as new Pers Area does not fit to old Geozone

b) Geozone should be displayed in the workflow overview page as it needs to be updated

-> it should not be possible approve and save inconsistent data, even if they are not displayed on the screen

Parent / Child Visibility Setting Issue

Object Config 1

Parent > visible > YES

Child    > visible > YES

No issue Envisage. Works as expected.

Object Config 2

Parent > visible > NO

Child    > visible > YES

No issue Envisage.

However, you will only have the option to select child object that fits to the parent object. No data inconsistencies are possible. Works as expected.

Object Config 3

Parent > visible > YES

Child   > visible  > NO

Not Supported - We cannot support follow up activities on a child field that is not visible.

Logic: The only point where we check the follow up activities is if the user clicks on "SubmitWorkflow".

After the admin, would provide the child object information (because the manager cannot see this field) we will not check again for follow up activities. No plans to change this behaviour.

Therefore, we don’t support a process were a parent object is visible but the user has no permission to see a child object. In such case follow up activities cannot be triggered. This is how the system is built.

Object Config 4

Parent > visible > NO

Child    > visible > NO

We strongly recommend to make the child object visible for the managers in your process setup.

Workaround: if you still want to proceed with such configuration.

Please use a business rule to clear the wrong value in the child object to avoid data inconsistencies.

This rule will clear the child object and the admin can provide the information in a workflow step.

Child Parent Object Visibility Inconsistent Association Associated Object Permission , KBA , LOD-SF-EC-JOB , Job Information , Problem