It's probably pretty simple to do this, but I'm unable to make it work properly...
Example:
User "Homer" is a member of group "Simpsons".
The "Simpsons" group has Read access for document type "simpson_doc".
The process "goDoSomething" can be run by any member of group "Simpsons".
Only the owner of a "simpson_doc" should have permission to start "goDoSomething" with the document.
How do the ACLs need to be set up on the Document and Process to allow all "Simpons" to Read Homer's document, but only allow Homer to submit the document to "goDoSomething"?
I've tried different combinations, but no luck... it's all or nothing.
Thank you for any advice.