Explain Security shows why a user has the access they have to a Record and to each of its documents. It lists every security rule that was checked, whether it applied to that user, and the access level after each step. It is on the Record screen under the Admin Actions menu in the footer and is available to Administrators. It changes nothing; it only reports.

Use it when someone cannot find a Record they expect to see, cannot open a document, or can edit something that should be read only. Instead of reading through the Record Type, its categories and the data on the Record by hand, you see the rules in the order the system applies them, with the answer at the end.

Choosing the user

The dialog opens explaining your own access. To explain someone else's, pick them in the Explain for list at the top; the results reload for that user. Refresh runs the check again, for example after you change a setting in another tab.


You must be able to open the Record yourself. Administrators are subject to Record security like everyone else, so documents that are hidden from you are not listed, even when you are explaining another user. The Documents panel says how many documents were left out for that reason.

Reading the results

The top of the dialog shows the user's name and teams, the Record Type the Record belongs to, and the Base Security from System Options, which is the level a user gets when no rule decides otherwise.


Two summary panels follow.

  • Search results and the Record screen shows the level the user actually gets on this Record, or Not found when the Record is hidden from them. This is the real answer, taken from the same search the Record screen uses.
  • Starting level for documents shows the Record's level before any Category rule is applied. Every document on the Record starts from this level.


Next comes Security @ values on the Record, which lists any of the special values below that are stored on the Record, with what each one does for the user you chose. Other values that start with @ have no effect on security and are not listed.

  • @SECURE holds a user name or team name. It gives Read Write to the user or team it names. When Secure Individual Records is turned on in System Options, it also hides the Record from everyone it does not name.
  • @@SECURE gives Read Write to the user or team it names, like @SECURE, but never hides the Record from anyone.
  • @ALLOWUSER holds a user ID, user name or team name. It raises the named user or team to Read Write, unless another rule has already taken their access away completely.
  • @LOCKUSER locks the Record to the user or team it names. Everyone else gets Read Only. A document can carry its own @LOCKUSER as well, which works the same way for that document alone.
  • @RECORDLOCK locks the Record for everyone. Nobody gets more than Read Only.
  • @APIONLY marks a Record used by integrations. It is left out of searches but can be opened directly by its ID.

The rule lists

The Record: search path panel lists the rules that decide whether the Record is found and at what level. The Record: level documents start from panel lists the rules that produce the starting level for documents. Each row has these columns.

  • Where says what kind of rule it is, such as Record Type, Record Security, Category or Document Lock.
  • Rule names the rule, for example the Record Type list or the Category it comes from.
  • Applies shows a check mark when the rule applied to this user and this Record. Rows that did not apply are shown grayed out.
  • Detail gives the values that were compared, such as the team that put the user on a list or the field value a Record Security rule looked for.
  • Level after is the user's access level once that row has been applied.


A Record Type row appears only when the Record matches that Record Type. If the user is not on any of the Record Type's lists, a row says the Record Type grants nothing, and the user's level comes from the other rules or from the Base Security.

Documents

The Documents panel lists each document on the Record with its Category and Sub Category and the level the user gets. Click a document to see the rules that were checked for it.

Each document starts from the Record's level. The system then checks the document's Category, then its Sub Category, then its Document Name, and at each step a rule that names the user replaces the level so far. That is why a Category can make a document more open or more restricted than the Record itself. Within one step, No Access wins over Read Write, and Read Write wins over Read Only. Finally, if the document is locked to someone else, the user gets Read Only.

When the explanation and the result disagree

Each panel compares the rules it lists with the level the system really gave the user. If they do not match, a red note says so, and in the Documents panel the document shows what the rules say next to its real level. The real level is always the one that applies. A mismatch means a rule is involved that the explanation does not show; contact support with the Record and the user if you see one.