When workflow was first introduced, changing a record’s status through workflow was subject to the user’s security permissions. However, many people found this difficult to manage. As a result, IBM changed this behaviour so that status changes performed through workflow bypass the user’s security permissions (APAR IZ75056).
In many cases, however, this is not the desired behaviour. Enforcing security rules now needs to be implemented within the workflow logic itself. I see two major problems with this approach:
- It adds complexity to the workflow design, making workflows harder to maintain.
- It removes the ability for administrators to manage status-change security through the out-of-the-box Security Groups application.
One question that often comes up is: how can we make workflow respect the user’s security settings when changing a status?
I found an IBM article that provided an automation script to restore the original behaviour, but unfortunately, the link is no longer available.
So, here is the code I came up with. It can be used as a starting point to restore the basic status-change restrictions for standard Work Order statuses and the standard signature options configured in Security Groups.
If you have access to the original IBM article or its automation script, I would appreciate it if you could share it. It would be interesting to compare the original solution with this approach.
For environments with custom statuses, additional signature options can also be created for each external status to provide more granular control over who can perform each status change.
Automation Script Details:
- Script Name: OBJ_WORKORDER_SAVE
- Launch Point:
- Object: WORKORDER
- Event: Save (Add/Update)
