Security and Permissions

Automation should respect the same role and data boundaries as the rest of the app. A workflow is not customer-ready if it only works for the app owner.

Permission questions to answer

Who can start the workflow?
Who can see the source record?
Who can receive the work?
Who can act on the Decision screen?
Who can see the Work Queue?
Who can see Workflow Status?
Who can see Conversation messages?
Who can repair exceptions?
Who can publish changes?

Role testing

Test with the least-privileged role that should use each step. If the owner can see everything but the reviewer cannot, the workflow is not ready.

Common permission failures

Failure	What happens	Fix
Recipient lacks screen access	The item routes but screen appears empty.	Grant screen visibility to the recipient role.
Recipient lacks source record access	The item appears but cannot open.	Update data restrictions.
Requester cannot see result	User thinks the process disappeared.	Show source status or Workflow Status.
Maker lacks exception access	Failures cannot be diagnosed.	Grant Exception Resolution to maker/admin role.

Safe default

Give users only the screens and records they need. Give makers validation and exception access. Give admins repair and publish access.