Hello,

In this scenario, the most effective approach is to separate permission management by role type. For roles like Y, where all users should have access to records without additional conditions, standard object-level record permissions can be used without any changes.

For role X, where access must be limited to specific users within the same role based on certain conditions, permissions should be managed exclusively through a business process. The process can be triggered on record creation (and, if required, on record update) and grant access only to the users who meet the defined criteria.

To avoid unintended access, the X role should not be included in the object-level record permissions. This is important because object-level permissions are recalculated whenever role settings change, which is what currently causes all existing records to become visible to all users in role X. When access is granted through a business process, it is not revoked during permission recalculation, and users retain only the access explicitly assigned by the process.

With this approach, adding or modifying roles no longer requires re-running processes for all existing records. Access remains controlled and consistent, and only the intended users within role X will have permissions to the relevant records.

Hello,

Currently, Creatio does not provide an out-of-the-box option to configure user- or role-based access permissions specifically for MS Word reports.

It is also not possible to enable record permissions selectively "only for some reports." The SysModuleReport table contains definitions for all report types, and enabling record-level permissions on this entity would affect the entire reporting subsystem. This may lead to unpredictable behavior, including incorrect report visibility or access issues for other users and report types. For this reason, modifying its permission model is not recommended and is not supported as a partial or isolated configuration change.

If the project requires strict access control to specific reports, this can only be achieved through a custom development approach (e.g., custom UI logic, custom section replacing standard report generation buttons, or intermediary permission checks).

Hello.

There is a table in the database, where all rights for the object are stored.

The table is called Sys+Object+Right (SysOpportunityRight, SysActivityRight, SysCaseRight etc).

More information can be found here:
https://community.creatio.com/articles/what-database-tables-should-i-ta…

Unfortunately, you can't read this object by the 'read data' element in the business process.

But your business task could be achieved by the script-task. 

Best regards,
Antonii.
 

Antonii Viazovskyi writes:

Hello.

There is a table in the database, where all rights for the object are stored.

The table is called Sys+Object+Right (SysOpportunityRight, SysActivityRight, SysCaseRight etc).

More information can be found here:
https://community.creatio.com/articles/what-database-tables-should-i-ta…

Unfortunately, you can't read this object by the 'read data' element in the business process.

But your business task could be achieved by the script-task. 

Best regards,
Antonii.
 

Thanks!

++

Sasori Oshigaki,

Hello , this Code should work 
{
  request: "crt.LoadDataRequest",
  handler: async (request, next) => {
    // Check if this is your MultiSelect's data source
    if (request.dataSourceName !== "MultiSelect_lf952eo_List_Items_DS") {
      return await next?.handle(request);
    }
 
    try {
      // MAIN filter group for the lookup
      const filter = new sdk.FilterGroup();
      filter.logicalOperation = sdk.LogicalOperatorType.And;
 
      // Build a nested OR group for the 3 roles
      const roleOrGroup = new sdk.FilterGroup();
      roleOrGroup.logicalOperation = sdk.LogicalOperatorType.Or;
 
      // Role 1
      await roleOrGroup.addSchemaColumnFilterWithParameter(
        sdk.ComparisonType.Equal,
        "[SysAdminUnit:Contact:Id].[SysUserInRole:SysUser:Id].SysRole.Name",
        "Marketing"
      );
 
      // Role 2
      await roleOrGroup.addSchemaColumnFilterWithParameter(
        sdk.ComparisonType.Equal,
        "[SysAdminUnit:Contact:Id].[SysUserInRole:SysUser:Id].SysRole.Name",
        "Sales"
      );
 
 
      // Add the OR group to the main filter
      filter.add(roleOrGroup);
 
      // SDK workaround for versions < 8.1.1 (copy items)
      const newFilter = Object.assign({}, filter);
      newFilter.items = filter.items;
 
      // Push the filter into the request
      request.parameters.push({
        type: "filter",
        value: newFilter
      });
 
      return await next?.handle(request);
    } catch (error) {
      console.error("Error filtering contact list:", error);
      // Continue with original request if filtering fails
      return await next?.handle(request);
    }
  }
}

Hello Sasor,

To achieve the requirement where specific organizational and functional roles can only see records relevant to their combination (e.g., Europe/Marketing can only see Europe/Marketing records), you can configure access permissions in Creatio by following these steps:

1. Create Organizational Roles:
Ensure you have the organizational roles "Europe" and "Asia" set up in the system.
 

https://academy.creatio.com/docs/8.x/setup-and-administration/administration/user-and-access-management/user-management/organizational-roles

2. Create Functional Roles:
Ensure you have the functional roles "Marketing" and "Sales" set up.
 

https://academy.creatio.com/docs/8.x/setup-and-administration/administration/user-and-access-management/user-management/functional-roles

3. Assign Users to Roles:
Assign users to the appropriate combination of organizational and functional roles (e.g., users in Europe/Marketing should be assigned to both the "Europe" organizational role and the "Marketing" functional role).
 

https://academy.creatio.com/docs/8.x/setup-and-administration/administration/user-and-access-management/user-management/assign-a-user-role

4. Configure Record Permissions:
- Go to the System Designer and open the Object permissions section.
- Select the object for which you want to configure permissions (e.g., a specific entity or section).
- Set up record-level permissions to restrict visibility based on both organizational and functional roles.
This can be done by creating filters or conditions in the access settings that check for both role types assigned to the user.

https://academy.creatio.com/docs/8.x/setup-and-administration/administration/user-and-access-management/access-management/record-permissions

Let me know if you have any more questions - happy to help further.

Hello Valeriia,

Thank you for the answer. Are you suggesting that this combination might achieve what we need?

Thank you 

Sasor

Greetings! 

For the user to work through OData, you need to grant them access using the CanUseODataService code in the Operation permissions section. 

Are you sure the remaining access rights for All employees role is not "Deny"? I believe that process element won't technically remove the access rights, you'll still see it there but will be "deny" instead of allow.

Hello!  
 

I created a similar business process and successfully ran it. 

The process worked correctly, and I’m attaching screenshots as proof.  

You can also set the field "Which access rights to add?" to "All employees—Restrict", and the process should work as you expect.

In my example, I did exactly that, and I’m attaching the screenshots:





The reason why permissions are not changing as expected might be due to incorrect configuration of the "Change Access Rights" element in the business process. Please review the configuration of this element and ensure that the correct conditions and access rights are specified.  
 

If everything seems correct, please create a support request by contacting support@creatio.com. 

We will review the issue and assist with a solution.  

Regards,
Orkhan

I was able to successfully set the rights for the employees according to the instructions; interestingly enough, the rights edit page does not show that anything has changed. 

Could you please provide us with more details. For example, which permissions do you have on Contacts object.

Hello

You should be able to delete records from the feed either on the feed page itself or from the communication panel, but only your own records. You cannot edit or delete other people's notes.

Dymytriy Vykhodets,

I understand, in that case how can you turn on the ability to edit own records 

Michał Zieliński,

Hello,

This option should be enabled by default. We would need to get access to your environment in order to investigate this issue. Please write to support@creatio.com and we will assist you with the request.

Hello Sasori,

According to your description, the issue is that when modifying data in the "Communication Options Detail" object, the system attempts to update related data in the "Accounts" object, and the user doesn't have the necessary permissions for this action.

Bogdan,

Thats correct.The mentioned Role has only 'Reading' rights in the Accounts.

However we have applied columns permission in the Accounts fields (like Phone,Alternate Phone) that can be affected by the Update of the 'Communication Options Detail" object but still not working.

Sasori

Sasori Oshigaki,

Please contact our support team on this matter - support@creatio.com