Visibility rules (Process Portal, REST search, Workplace):
- Tasks: a user sees a task when they are in its assigned team (or the task is assigned to them directly), when they are a member of the team's managers team (team managers see and can reassign their team's tasks), or when they administer the process app.
- Instances: a user sees an instance when they participate in it (have or had a task in it), belong to the process app's instance administration team (the Administrators exposure of the process app), or hold a platform administrator role - those see everything in Process Admin's Process Inspector.
- Saved searches and dashboards: a search returns only the instances and tasks the user can see by the rules above; there is no row-level filtering on business data - "region" must be encoded in team membership.
Region isolation therefore uses teams per region: one team "Approvers DE", "Approvers FR" (backed by LDAP groups), a team filter service choosing the region team per task from instance data, and manager teams per region; nobody outside the region participates, so nobody outside sees the instance. Administrative roles (Process Admin, the app's administrators team, tw_admins) must be limited to a central operations group - they see everything by design. Exposed dashboards can be limited per team, so a "DE manager dashboard" is exposed only to the DE managers team.
// team filter service "Region approvers": input team = super team "Approvers"; output filteredTeam limited to the request's region
var region = tw.local.request.region; // mapped from the activity
var group = tw.system.org.findRoleByName("approvers_" + region.toLowerCase()); // security group of the region
tw.local.filteredTeam = new tw.object.Team();
tw.local.filteredTeam.name = "Approvers " + region;
tw.local.filteredTeam.members = new tw.object.listOf.String();
if (group != null) for (var i = 0; i < group.users.length; i++) tw.local.filteredTeam.members.insertIntoList(i, group.users[i].name);
if (tw.local.filteredTeam.members.listLength == 0) tw.local.filteredTeam.members.insertIntoList(0, tw.env.fallbackUser);Workplace on CP4BA applies the same rules through Process Federation Server and additionally shows only the process apps exposed to the user. When true row-level security on business data is needed everywhere, separate process apps or separate Workflow instances per business unit are the cleaner design.
References