Explain Security shows why a user has the access they have to a Record and to each of its documents. It lists every security rule that was checked, whether it applied to that user, and the access level after each step. It is on the Record screen under the Admin Actions menu in the footer and is available to Administrators. It changes nothing; it only reports.

Use it when someone cannot find a Record they expect to see, gets Record Not Found from a link or a workflow item, cannot open a document, or can edit something that should be read only. Instead of reading through the Record Type, its categories and the data on the Record by hand, you see the answer at the top and the rules below it, in the order the system applies them.

Choosing the user

The dialog opens explaining your own access. To explain someone else's, pick them in the Explain for list at the top; the results reload for that user. Refresh runs the check again, for example after you change a setting in another tab.

You must be able to open the Record yourself. Administrators are subject to Record security like everyone else, so documents that are hidden from you are not listed, even when you are explaining another user. The Documents panel says how many documents were left out for that reason.

Reading the results

A large banner at the top gives the answer: the access the user actually gets when they open this Record.

  • NO ACCESS (red) means the user cannot open the Record. The banner says which message they see: Record Not Found, or You do not have access to this Record.
  • READ ONLY ACCESS (yellow) means the user can open the Record but cannot change it.
  • READ WRITE ACCESS (green) means the user can open and change the Record.

The answer is the same however the user reaches the Record: from search results, from a link, or from a workflow item. All of them open the Record the same way, so a user who gets Record Not Found from a workflow link would not find the Record in a search either. The banner also names the step in the rule list that decided the answer.

Below the banner are the user's name and teams, the Record Type the Record belongs to, and the Base Security from System Options, which is the level a user gets when no rule decides otherwise.

Next comes Security @ values on the Record, which lists any of the special values below that are stored on the Record, with what each one does for the user you chose. Other values that start with @ have no effect on security and are not listed.

  • @SECURE holds a user name or team name. It gives Read Write to the user or team it names. When Secure Individual Records is turned on in System Options, it also hides the Record from everyone it does not name.
  • @@SECURE gives Read Write to the user or team it names, like @SECURE, but never hides the Record from anyone.
  • @ALLOWUSER holds a user ID, user name or team name. It raises the named user or team to Read Write, unless another rule has already taken their access away completely.
  • @LOCKUSER locks the Record to the user or team it names. Everyone else gets Read Only. A document can carry its own @LOCKUSER as well, which works the same way for that document alone.
  • @RECORDLOCK locks the Record for everyone. Nobody gets more than Read Only.
  • @APIONLY marks a Record used by integrations. It is left out of searches but can be opened directly by its ID.

The rule lists

The How access to the Record is decided panel lists the rules that decide whether the user can open the Record and at what level. The Documents start from panel shows the Record's level before any Category rule is applied, which is the level every document on the Record starts from, and lists the rules that produce it. Each row has these columns.

  • The first column is the step number. The rules are checked in order, starting at step 1.
  • Where says what kind of rule it is, such as Access, Record Type, Record Security, Category or Document Lock.
  • Rule names the rule, for example the Record Type list or the Category it comes from.
  • Applies shows a check mark when the rule applied to this user and this Record. Rows that did not apply are shown grayed out.
  • Detail gives the values that were compared, such as the team that put the user on a list or the value a Record Security rule looked for.
  • Level after is the user's access level once that row has been applied.

The last row is not the answer. Once a rule stops the user from opening the Record, the steps after it still run and can show a higher Level after, but they no longer matter. The step that decided the answer is highlighted and marked decides, and the banner at the top always shows the real result.

A Record Type row appears only when the Record matches that Record Type. If the user is not on any of the Record Type's lists, a row says the Record Type grants nothing, and the user's level comes from the other rules or from the Base Security.

Record Security rules

Record Data Security rules on the Record Type limit a user to the Records whose data matches. Every rule on the Record Type is listed, whether or not it applies to the user.

  • A rule that applies to the user shows each field it checks, with the value on this Record next to the value the rule wants, for example DirectReport is 'mjones', rule wants 'jsmith' ([USERNAME]). A variable such as [USERNAME] is shown already filled in for the user you chose. A field the Record does not have shows as not on the Record.
  • A rule that does not apply to the user is grayed out, with the reason in the Rule column in the same terms as the Record Type screen, for example Not In Teams includes Payroll, which the user is in. Its fields are not checked.
  • A Record Security result row then says whether the user can open the Record. When at least one rule applies to the user, they can open the Record only if one of those rules matches, and a rule marked Exclusive Rule must match as well. A user who has no rule applied to them is not limited by Record Security at all.

Documents

The Documents panel lists each document on the Record with its Category and Sub Category and the level the user gets. Click a document to see the rules that were checked for it.

Each document starts from the Record's level. The system then checks the document's Category, then its Sub Category, then its Document Name, and at each step a rule that names the user replaces the level so far. That is why a Category can make a document more open or more restricted than the Record itself. Within one step, No Access wins over Read Write, and Read Write wins over Read Only. Finally, if the document is locked to someone else, the user gets Read Only.

When the explanation and the result disagree

The explanation compares the rules it lists with the access the system really gave the user. If they do not match, a red note in the banner says so, and in the Documents panel the document shows what the rules say next to its real level. The banner and the real level are always the ones that apply. A mismatch means a rule is involved that the explanation does not show; contact support with the Record and the user if you see one.