Record-Level Security

What is record-level security?

Record-level security controls which rows of data each user can see in a record type. By default, any user with Viewer permission to the record type can see all available records. Record-level security adds granular access control on top of that default behavior.

Record-level security configuration uses plain language or expressions. Once configured, Appian automatically enforces record-level security throughout your applications—ensuring that only the right users can see the right data.

For example, in a support case application, administrators can see all cases, support engineers can only see their assigned cases, and account managers can only see cases related to their customers.

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

Record-level security on the Support Case record type controls which data is available to each of these groups. The following image shows how administrators and support engineers see different records when looking at the same Case Burndown report.

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

Supported record types for record-level security

Record-level security is available on record types that use Optimized Data Access (synced) or Direct Data Access with features enabled (unsynced).

Record-level security is not available on legacy record types.

Where is record-level security applied?

Record-level security is automatically applied everywhere the record type is used, including record lists, queries, grids, charts, and related record data.

Record-level security options

Record-level security can be configured using one of the following options:

• Security rules: Configure complex security requirements using a guided, easy-to-maintain experience.
• Security expression: Configure an expression using filter conditions to define who can see which records.

The following table outlines the key differences between security rules and security expressions:

Use security rules

Security rules allow you to translate complex security requirements into plain language by answering two questions: who is a part of this rule? and which records can they view?

Who is a part of this rule?

The first element of a security rule defines which users the rule applies to.

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

You can specify the users assigned to a security rule by selecting one of three options:

• Users found in groups: Assign users from one or more groups.
• Users found in fields: Assign users found in a User or Group field.
• Users who can view related records: Assign users who can see related records.

Users found in groups

The Users found in groups option assigns users found in one or more groups to a security rule. When you select more than one group, the security rule applies to any user who belongs to any of the selected groups.

Use the Users found in groups option when you want to assign multiple users to a security rule based on group membership.

For example, in a support application, administrators and executives can see all cases in the Case record type. To configure this requirement, create a security rule that specifies any users found in the Administrators group or the Executives group can see all cases.

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

Any time you add new users to your groups, they will be automatically assigned to the security rule.

Users found in fields

The Users found in fields option assigns any users found in a User or Group field to the security rule.

The Users found in fields option provides a dynamic configuration because security requirements are defined by your data. You can select record fields or related record fields in the configuration.

For example, in a support case application, support engineers can only view cases assigned to them. In the Case record type, add a security rule that specifies: if a user is found in the assignedEngineer field (which is type User), then that user can see the case.

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

With the Users found in fields configuration, support engineers only see their assigned cases. If the data changes and a support engineer is no longer assigned to a support case, the security rule automatically reflects the data change so the engineer can no longer see the case.

To learn how to configure a record field as type User or Group, see Change record field names and data types.

Users who can view related records

The Users who can view related records option assigns any users who can see related records to the security rule. The option leverages record type relationships so you can extend existing security rules on a related record type to the base record type.

For example, in a support case application, account managers can only view cases related to their customers. The security rules on the Customer record type define which account managers can see which customers. If you select the Users who can view related records option on the Case record type and select the customer relationship, the Customer security rules extend to the Case record type.

Any user who can view a customer can also see that customer's cases.

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

If you select a one-to-many relationship in the security rule, then users who can see at least one related record can also see the base record.

For example, to extend security rules from the Case record type to the Customer record type, use the Users who can view related records option on the Customer record type and select the case relationship. Any users who can see at least one case can also see the customer.

The Users who can view related records option avoids recreating security rules across numerous record types by inheriting the security rules from a related record type.

Which records can they view?

Once you assign users to the security rule, you can add security conditions to define which records the assigned users can view.

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

Depending on how you assigned users to the security rule, Appian applies certain default security conditions:

Default conditions are automatically applied and cannot be modified. You can add additional conditions as necessary.

For example, account managers can only view customer cases created in the last month.

To configure this requirement, first select the Users who can view related records option so any user who can view a customer can also see their cases. Then, add an additional security condition so that those users can only see cases with a creation date greater than or equal to the beginning of last month.

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

Security conditions are made up of fields, operators, and values. Depending on the selected field, the available operator and value options change.

Fields

The field picker contains all record fields and relationships defined in the record type. Depending on how you assigned users to the security rule, the fields available for selection vary:

If you create multiple conditions against fields from the same one-to-many relationship, then Appian will combine those filters using the AND_ALL operator.

For example, support engineers can only view a customer if they are assigned to an active case for that customer and that case has a service-level agreement (SLA) status of "On Time."

The security rule configuration for this requirement looks like this:

Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

Since the security conditions reference fields from the same one-to-many relationship, the AND_ALL operator will be applied so that only users who meet all of the security conditions can see the record.

Operators

The operator list displays all of the operators that can be applied to the selected field. Only operators that are compatible with the data type of the selected field display.

The following tables explains the behavior of each available operator:

Values

You can select how you want to pass in the condition value using the value context menu. The options in the context menu change based on the data type of the selected field. You can enter a static text value, or use a constant to determine the value the field must evaluate to in order for users to view the record.

Add security rules

You must have at least Editor permissions for the record type to add or update security rules.

To add a security rule:

1. In the record type, go to Record-Level Security.
2. Click NEW SECURITY RULE. The Create New Security Rule dialog opens.
3. Choose Who is a part of the rule:
   • Users found in groups.
   • Users found in fields.
   • Users who can view related records.

4. Determine Which records can they view by adding one or more security conditions. Depending on the members you assigned to the security rule, the configuration differs:

   If you selected…	Then…
   Users found in groups	Select Only records where… to configure a security condition.
   Users found in fields	A default security condition is applied where users can only see records where they are listed as the user or group in that field. To add more conditions, click + Add Additional Conditions.
   Users who can view related records	A default security condition is applied where users can only see records if they can see the related record in the related record type. To add more conditions, click + Add Additional Conditions.

5. To configure a security condition:
   • Use the field picker to choose a record field or related record field.
   • Select an operator to apply to the selected field.
   • Enter a static text value, or use a constant to determine the value the field must evaluate to in order for users to view the record.
   • Click + Add Condition to add additional security conditions. Use the OR/AND operator to determine how the security conditions are evaluated.
   • Click Add Condition Set to compare a set of conditions against another set of conditions.

6. Click CREATE.

   Tip:  To add another security rule immediately after creating one, click CREATE AND ADD ANOTHER RULE instead.

7. Click NEW SECURITY RULE to add additional security rules.
8. Drag and drop a security rule to reorder the list of security rules.
9. In Test Security Rules, enter the name of a user in your environment.
10. Click TEST to see the number of records visible to the selected user.

11. Click PREVIEW RECORDS to see a list of records visible to the selected user.

    Note:  When previewing record data, you can only see records that both you and the selected user have access to view.

    

    Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

12. Click SAVE to save and apply your security rules.

Manage security rules

Once you create a security rule, you can manage it using the following actions:

• Edit security rules: Modify the configuration of an existing rule.
• Copy security rules: Duplicate a rule and modify the copy.
• Reorder security rules: Change the evaluation order of rules.
• Disable security rules: Temporarily turn off a rule without deleting it.
• Delete security rules: Permanently remove a rule.

Edit security rules

To edit a security rule:

1. In the record type, go to Record-Level Security.
2. Next to the security rule, click the icon.
3. Update any necessary configurations.
4. Click OK.
5. Click SAVE to save and apply your updated security rule.

Copy security rules

To copy a security rule:

1. In the record type, go to Record-Level Security.
2. Next to the security rule, click the icon.
3. Update the existing configurations as necessary.
4. Click CREATE.
5. Click SAVE to save and apply your new security rule.

Reorder security rules

To reorder a security rule:

1. In the record type, go to Record-Level Security.
2. Drag and drop a security rule to the appropriate location.
3. Click SAVE to save and apply your updated security rule order.

Disable security rules

To disable or enable a security rule:

1. In the record type, go to Record-Level Security.
2. Use the toggle next to a security rule to disable or enable the security rule.

When a security rule is disabled, Appian does not evaluate the rule when testing or anywhere throughout the application. If you disable all security rules, any user with Viewer permissions for the record type can view all records.

Delete security rules

To delete a security rule:

1. In the record type, go to Record-Level Security.
2. Next to the security rule, click the icon.
3. Click DELETE.
4. Click SAVE to update your record-level security.

If you delete all security rules, any user with Viewer permission for the record type can view all records.

Use a security expression

Security rules handle the majority of use cases, but a security expression can define more complex conditions.

A security expression uses a series of filter conditions with a!queryFilter() or a!queryLogicalExpression(). The filters define which records are available to users based on the conditions you specify.

Each filter defines a condition that must be true for a record to appear in queries to the record type. If you have multiple conditions, the record must meet all conditions in order to appear.

Security expression limitations

Before configuring a security expression, consider the following limitations:

• Cannot combine with security rules: A record type can use either a security expression or security rules, but not both.
• No inheritance: Related record types cannot inherit security expressions.

For easy maintenance, use security rules whenever possible.

Add a security expression

To add a security expression:

1. In the record type, go to Record-Level Security.
2. Click Configure a security expression.
3. In the expression editor, enter an expression using a!queryFilter() or a!queryLogicalExpression().
4. Click CREATE.
5. Click SAVE.

Example security expression

In a support case application, users can only see unassigned cases if they are members of the Support group and are not assigned to a case.

Since the membership conditions are more complex, configure a security expression on the Case record type:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
a!queryLogicalExpression(
  operator: "OR",
  filters: {
    a!queryFilter(
      field: recordType!Case.fields.assignedEngineer,
      operator: "=",
      value: loggedInUser()
    ),
    a!queryFilter(
      field: recordType!Case.relationships.employee.fields.manager,
      operator: "=",
      value: loggedInUser()
    )
  }
)

Replace a security expression with security rules

If you prefer to maintain record-level security using security rules, you can remove the security expression and use security rules instead.

To replace a security expression with security rules:

1. In the record type, go to Record-Level Security.
2. Select the Security Rules radio button at the top of the page.
3. Add a new security rule.
4. Click SAVE.

Feedback