Business Letter / Confidentiality

[0xD0M1M0]

Problem Statement:

Some business letters contain sensitive information and may not be suitable for sharing across the entire company by default. Currently, the standard access permissions for the "Employee" role allow all employees to view such documents, which may lead to unintended information disclosure.

Proposed Solution:

1. Default Access Adjustment

• Set the document access option to "Only if Creator" for the "Employee" role as a default setting. This change would restrict document visibility to the original author (creator), who can then manually share the document if required.

2. Create a New Role: "Business Letter Author"

• Introduce a new role titled "Business Letter Author", which would have the same base permissions as the "Employee" role.
• Enhance the business letter document type with additional fields like sender and department (both optional).
• These fields can be used to configure more granular permissions, such as limiting visibility to only the document's sender or department.
• This configuration allows for cases where the author is drafting a letter on behalf of a different sender or for a specific department.
• Add-On: On selecting the "Business Letter Author" Role in the user profile, the first basic "user-permission" is set to "user" for "business letter"

3. Add documentation to support setting up "Business Letter-Usage"

Impact:

Implementing these changes would improve confidentiality management and allow business letters to be shared on a need-to-know basis, maintaining data privacy and appropriate access levels.