RELATED IDEAS
Authorship Control Gap in Unlocked Records
Despite the existing security role configurations and the recent enhancement of ball-in-court workflows to restrict permissions, the platform still presents an authorship control issue with unlocked records.
The issue arises because users with “create” permissions also have the ability to modify or delete content created by others.
This behavior applies to links, comments, and the “Done” checkbox in action items. We have observed that any user can modify or delete these elements, regardless of whether they are the original author.
Our expectation is that, based on the assigned security roles, users should only be able to create, edit, or delete records they have authored. However, this is currently not being enforced.
Additionally, assignees should be limited to commenting, responding, and editing their own comments and links, without the ability to modify or delete content created by others. This represents a security control gap within the platform.
