Restricting access on part of a project via template?

[SkyeHa]

We're normally a pretty collaborative bunch but some of the PMs are starting to want to restrict access to specific files (in a Workfront project). Normally assigned workers to tasks have visibility into the project which means they can access all files in a project. Is there an automatic way to lock the access/visibility such that they aren't able to randomly open files? I know that if a document is uploaded to a task with restricted access, the document inherits restricted access. But project tasks created from a template inherit access based on the project permissions and task assignments, and there is no way to separately set a template task sharing permission that will override this. Did I miss something? Does anyone have further thoughts? I hate making my PMs manually set up a task with restricted access in order to upload their documents into, but this is my only workaround right now. Thank you! -skye

[HarryTh1]

Regardless of the task details, you can always control visibility at the individual document level through the document's Details>Sharing, which is how we've handled this situation in the past. As you pointed out though, by default the document inherits the sharing of the project/task, so you have to physically go in and remove those inherited permissions, which isn't ideal. I think for us the best case scenario would be to be able to control visibility based on which folder a document resides in, but that's not currently an option either. Harry Thompson Lowe's Companies, Inc.

[Kelly_Wehrmann]

@Harry Thompson , I really like your idea of being able to have sharing options on folders. Have you submitted this on the idea exchange? If so can you send me a link so I can vote on it? Thanks! Admin Kelly-Wehrmann SSFCU

[SkyeHa]

Thanks Harry, I appreciate the thought. There are a few dozen tasks that involve uploading sensitive files into Workfront, so having to change the doc sharing with every upload would be a bit more of a pain. Right now, I've created a File Uploads task marked as Urgent in the template and placed instructions on how to restrict sharing. They'll just go to this task every time, and put the files in there. -skye

[darinpatterson]

Hi Skye, This is an interesting topic. As it happens, I've been recently delving into inherited permissions in a deep way lately. One potential option is applied at the "Access Level", where you can identify (for users that have that access level) that users should not "automatically inherit" access to documents uploaded to a project (or task). Of course, that means that you would then need to explicitly share a document with others when you do want to share. See "Set additional restrictions" in access level setup. The attribute is: "Never inherit document access from projects, tasks, issues, etc.". Darin Patterson Workfront

[SkyeHa]

thanks @Darin Patterson . I had no idea that even existed :). I assume this is the thing that would put someone on (or take them off) an "inherited permissions" list for a document in a project/task/issue. Unfortunately it isn't a solution for our case . We normally would want to share documents within a project, but there are some projects where specific groups do not want to share "their" documents. So an assigned worker would normally want to inherit document access from all the projects, but then 2 PMs are going to want more privacy for half their documents. Harry's comment about being able to apply access settings per folder is a closer fit for this situation. Even so, we really need to be able to apply these access settings at a Template level otherwise we have to make manual adjustments to every project. Even being able to apply task sharing at the Template level would be a good workaround for us--so that the PM can set some tasks as not accessible in a template instead of in each task. One additional point: folders in a task are not visible in a project, so even when we set up folders in a locked task, when we put files in them, the files show up in the project documents tab, minus their folders... -skye

[William--]

"But project tasks created from a template inherit access based on the project permissions and task assignments, and there is no way to separately set a template task sharing permission that will override this." I had a similar need here. Not sure that it is like for like, but here's what I ended up doing: - Created a new project, but did not automatically grant View access to the project for users who are assigned a task. - I also removed any inherited permissions from the project that were passed down from the portfolio/program levels. - Added project tasks and assigned them to users. - For tasks that require visibility beyond the project owner and assigned user, I added View or Contribute access in Task Actions >> Sharing. This project recurs bi-weekly. I am not using the Template feature, because the template strips the additional View/Contribute access that was set at the task level. Instead, I copy the project, set a new start date, and clear the task progress/custom form data. I end up with a new project with the same set of tasks that have retained their individual share settings from the prior project. All of these tasks are semi-private, so sharing is individually configured on every single task. If I had a lot of other tasks within the project that needed to be accessible to a wider audience, and did not want to set that audience for every task, I would contain all of the public tasks in a single parent, and allow View/Contribute to the wider audience on the parent. TLDR : Revoke all project permissions in both Project Sharing and Edit Project, re-add permissions for every task/parent task in Task Sharing, copy the project instead of making it a template. William English