Question

Transparent Records Management Best Practice

Workflow

Updated April 9, 2015

asked on April 7, 2015

I've built a ton of Transparent Records Management (TRM) environments and read most of the posts out there and want to get a few opinions on the best way to handle a specific scenario that keeps coming up.

For this example I will use a Finance department that has their own repository and wants to implement TRM. They have 3 processes that are handled by 3 different templates and each process has it's own folder structure with it's own security. They want Records Management (RM) for all Finance documents to be handled in a single RM area so the records managers do not have to go to 3 different areas to destroy documents. Thus here is what their folder structure looks like:

Once a document is filed in RM, each process has 2 different levels of security (view and edit). I am trying to figure out the best way to assign the 2 different types of security in RM so that the users are only able to search and view documents they have rights to. Below are my options as I see them but I am hoping I am missing an obvious solution:

Assign Security Via Workflow at the Document Level
1. Controls both the groups and level of permission they have for every individual document
2. Requires more complex workflow to remove incorrect permissions, if a document is moved from one to another, and assign permissions when the document is filed
3. If security changes are made (new groups added), then all documents must go back through workflow to get the new security
Set Browse & Read to everyone at document level in RM
1. No workflow necessary to assign permissions
2. No major rework when security is changed
3. All documents are searchable even if the user should not have access to them
4. Only controls access to document, not specific security on the document
Create tags to secure documents
1. Controls document access with single tag
2. Can easily update groups that can see the tag
3. Requires more complex workflow to remove incorrect tags, if a document is moved from one to another, and assign tags when the document is file
4. Tags do not designate the level of access, just if you have access. Thus this does not work with assigning the 2 security levels on the document, only access to the document

Option 1 is the only way I can see to 100% control access to a document but it takes considerable work to build and even more if changes are made. I wish we could control document security via the shortcut used to access the document, as that would make TRM incredibly easy to build and maintain. Has anyone else found a better way to completely secure documents in a shared TRM environment with multiple security levels and still make it searchable or is document level security assigned via Workflow still the best answer?

1 0

Replies

replied on April 7, 2015

I may be missing the point, but it seems like the destruction process would be no more difficult if you kept the documents in similar Process 1, 2, and 3 folders inside the Records folder. After all, you have to search for docs that are eligible for destruction anyway, so it shouldn't make any difference if they happen to be in separate containers. I'm assuming you have one record manager with access and responsibility for all of the documents. That way the security inside the RM folder would be the same as on the outside, no?

0 0

replied on April 7, 2015

Barry I both appreciate your help and agree with your point. While I've already voiced this suggestion to the customers, in my initial explanation I advised that they want a single RM folder structure for all of these processes. Additionally, Workflow cannot create Record Series dynamically and each of these processes has 15+ Record Series that their various documents apply to. Therefore I am now asking this particular records manager to create 15+ record series folders for each process when many of them actually cross. Then when retention values change for these that same records manager has to go update the retention folders in multiple places instead of a single location. While at this scope these extra Record Series may seem small, in a large organization with 15 repositories, over 50 departments utilizing Laserfiche and 10,000,000+ documents in the system, these extra Record Series multiply quickly. They are wanting to minimize the number of Record Series across their environment to minimize both the number of places to maintain and the number of places where problems could arise.

But let's take the example a step further. Let's say Process 1 is invoices and beyond the initial request, they also want to restrict access to invoices based on department. I now have all of the invoices stored in a single Record Series but need to control access to each document based on the department that submitted the invoice. (I am currently receiving similar requests when it comes to departments viewing HR records.) With this option I would have to build separate Record Series for every department so that they are properly stored independently. This is neither easy to maintain nor can it be built dynamically since Workflow for some reason is not allowed to create Records Series.

I have more and more customers asking for dynamic environments that utilize TRM but are still secure. This is able to be built but it takes considerable work from a workflow standpoint and if any changes in security are needed (maybe a new level of permission) then everything has to go back through workflow to be assigned it's new security. Additionally, TRM is provided as a method to allow the users to have their folders configured how they want and the records managers RM configured the way they want. Once I start telling either side they can't have it that way because Laserfiche doesn't support it then TRM as a process falls apart.

The issue is that we are asking them to secure the shortcut(s) on one side and then secure the original document on the other. The users see the RM folder structure as a vault to protect the documents but it takes considerable custom work to create this vault and grant users the correct access in via a shortcut and through searching. If Laserfiche would allow security to be driven by the shortcut or Records Series to be built by Workflow then those would both be dynamic ways around this. As these do not appear to be on the horizon I am hoping someone has found a way to handle this in an easier to maintain/build method than what I've been doing so the customer can have a secure, dynamic, and easy to build/maintain environment in the folder structure that is the most efficient for all parties. If there is no better method then I am hoping to have open dialog regarding what we'd like to see coming for TRM as the requests are getting more complex and hopefully the tools to handle these requests will adapt.

0 0

replied on April 9, 2015

It's a complex configuration issue and you're in an unenviable position if end users simply disregard the inherent constraints every system imposes by it's design. I don't see a simple way around the problem, but my view is that in the long term document security and ease of maintenance for all users should trump twisting the system into a knot for the convenience of one or two record managers. In the example of your departmental invoices, having to create separate series isn't any different than what you would do using normal folders in the absence of TRM. The alternative there would be to try using folder filter expressions, but in a system as large as yours I'd test to see what the performance hit is on searching.

Given the current abilities of the system, could you design the system logically (i.e. with suitable Record Series having security that follows basic Laserfiche design principles) and then mitigate the pain of managing many Records Series with workflow in some way?

0 0

You are not allowed to follow up in this post.

Question

Question

Transparent Records Management Best Practice

Replies

Sign in to reply to this post.