Symptom
Benefit object is updated by a user who does not have 'Manage Data' permission or 'Configure Obejct Definition' permission.
Environment
Employee Central - Global Benefits
Reproducing the Issue
Navigate to Manage Data > Benefits > Open a particular benefit > Check last updated by.
The last updated by is the user who does no have 'Manage Data' or 'Configure Object Definition' permission.
Cause
Even if a user does not have 'Manage Data' or 'Configure Object Definition' permission, the user can update data from Workflow request. Navigate to 'Manage Pending request' in Home page > Click on the Benefit workflow > Click on the quick card which appears next to Benefit field > Click Manage and the user can change the benefit object (assuming Benefit is unsecured object i.e Secured = NO in Configure Obejct Definition > Benefits).
Resolution
The issue happens because the user had 'Access to non-secured objects (previously known as 'Read/Write Permission on Metadata Framework')' permission in RBP (Role Based Permission). Once this permission is disabled in RBP, the user will get an error 'You do not have permission to access this object' when user will click on Manage under the quick card of the benefit field in the workflow.
Keywords
Manage Data, Configure object definition, benefit, No permission to user, benefit object getting updated, benefit object getting changed, Update, change, permission, RBP , KBA , LOD-SF-EC-GBF , Global Benefits , Problem