Timesheet Workflow Participant Access Changes

Description

A new user security permission called Access only to timesheets if user is workflow participant has been added for the Time and Attendance module.

If this permission is enabled for a user, the Is Workflow Participant? field that is displayed in the search header on the Available, Incomplete, Rejected, Submitted, Bulk and Historical Timesheets screens in Time and Attendance is ticked by default and cannot be edited. That means that the user is only able to access timesheets for which they are a timesheet workflow participant (the user is the initiator, approver or the escalation contact for that timesheet).

If this permission is not enabled for a user, the Is Workflow Participant? field is enabled and defaults to the ticked state. That means that, by default, the user will only see timesheets for which they are an initiator, approver or escalation contact. However, the user can choose to un-tick the Is Workflow Participant? field to list timesheets for which they are not a workflow participant.

This new security permission is available in the 11.37 release for agency and client contact users only, and does not apply to candidates. However as a result of this change, Candidates will now only be able to access timesheets for which they are allocated as a workflow participant. That is, a candidate will not be able to access a timesheet that belongs to them if, according to the timesheet workflow, they are not the timesheet initiator.

The new Access only to timesheets if user is workflow participant security permission replaces the Override Is Workflow Participant security permission, which existed in prior versions of the system.

In addition to the above, the Is Workflow Participant? field is now also available in the Expired Timesheets Tab and will be ticked by default. If the user does not have Access only to timesheets if user is workflow participant ticked in their Security Role, the Is Workflow Participant? checkbox can be unticked if required.

Benefits

This enhancement reduces longer-term configuration overheads as it is no longer necessary to assign a user permission to all users who need to access to all timesheets while still allowing timesheet access to be restricted for specific users who do not have authority to access timesheets for which they are not a timesheet workflow participant.

By preventing candidates from accessing timesheets for which they are not a timesheet initiator, the system caters for situations where a candidate works multiple jobs simultaneously and is required to submit their own timesheets for one job but not the other. This change prevents the candidate from accidently accessing, keying in and submitting timesheets that are supposed to be submitted on their behalf by a client or agency timesheet initiator.

Configuration

To prevent agency users from accessing timesheets unless they are a timesheet workflow participant for a given timesheet, the Access only to timesheets if user is workflow participant user permission must be enabled for the users' security roles in Agency Portal > Maintenance > Security, as shown below.

On upgrade:

Where an existing security role has 'Override is Workflow Participant' ticked, the new Access only to timesheet if a user is workflow participant item will not be ticked, so users will not experience any change.
Where an existing security role has 'Override is workflow Participant' unticked, the new Access only to timesheets if a user is workflow participant will be ticked, so users will not experience any changes.

The new Access only to timesheets if user is workflow participant security permission replaces the Override Is Workflow Participant security permission, which existed in prior versions of the system.