The assigned rights to access and manupulate a document in Next®.
In Next® we adhere to the principle of privacy by design, as prescribed in the GDPR (General Data Protection Regulation).
This means, that by default no one has access to anything.
Group-based access control
For each document type in Next®, you then set up what permissions each user group should have.
Human resources and Payroll staff may get access to Payroll slips and Employment contracts.
Rule-base access control
In case you need more advanced permission control, Next® has an optional extension called Next® Extended Permission Control. It allows you to set permissions based on document metadata.
You have already restricted access to Employment contracts and Payroll slips to the staff in Human Resources. With extended permission control, you can take it further, and limit access based on not only the document type but also data from the individual document.
Only members of HR unit West may access documents with Location = West
and only members of the HR unit East may access the documents with Location = East.
You can even restrict the access to e.g. a purchase invoice, based on the coding applied to that invoice. This way, only the staff associated with a defined cost center have access to invoices booked to that cost center.
We are looking to introduce role-based permissions in addition to group- and rules-based permissions.
With role-based permissions, Next® will automatically generate the groups you need to manage access to documents using groups instead of individual permissions. If you are a project manager for project A, B & D, and a project member in project C & F, you will have the roles: Project manager (Project A), Project Manager (Project B), Project Manager (Project D), Project Member (Project C), and Project Member (Project F). When you later are replaced as Project Manager for Project A, all documents related to Project A will not have to be updated. The new Project Manager simply take over your role as Project Manager (Project A)
Next® Extended Permission Control also allows you to delegate additional permissions along the way. If you are processing a document and need input from a colleague that does not normally have access to this document, you may temporarily (or permanently) grant them the required permission.
I grant you permission to work with this for two weeks
For selected scenarios, you may even set up next so that this delegation of permissions happens automatically. But be careful that you do not undermine your intended security policies.
Please remember that in an enterprise archive folders do not protect documents - permissions do.
Be aware that delegated permissions persist until they expire. Even if other permission restrictions are applied in the meantime.