Workgroup Privileges override Security Policy

gddub

Trying to understand Workgroup Privileges and Security Policies. Using WorkSite MP build 4.1.1.6.2.

It seems that Workgroup Privileges override Security Policy. However, reading the help file suggests that Security Policy should apply. For instance setting Workgroup Privilege as Grant Delete, and setting Project Security Policy as Modify for the same Workgroup; the documents for a Project can be deleted. I would have expected the Security Policy to be set to Delete (not Modify) for this to happen.

Are Security Policies supposed to override Workgroup Privileges?

dbguy

Privileges control the operations users can do, regardless of the object. Security Policies control what can be done on the object itself. The server will first check if the user has the privilege to perform the operation and then check the object's policy to verify if the user can do that operation. Privileges do NOT override Security Policies.

What I think is happening in your example: the Security Policy in the Project does not control who can delete its documents. If I have delete access in the document's Security Policy, I can delete it. My guess is that the document's policy is different from the project's and is allowing the user to delete the document.