A developer is designing a custom application with a table that stores sensitive employee data. The requirement is that only managers can view records where they are the manager of the employee. Which two configurations are needed to implement this requirement?
Trap 1: Create a new view that excludes sensitive fields
Views don't enforce security; users could switch views.
Trap 2: Create a Business Rule that deletes records if the user is not the…
Business rules run on server and delete records, but don't prevent viewing.
Trap 3: Use a Client Script to hide fields if the user is not the manager
Client scripts can be bypassed; server-side ACL is needed.
- A
Use a UI Policy to set fields to read-only or invisible for non-managers
UI Policies can set field attributes like visible or read-only based on conditions.
- B
Create an ACL with a condition script that checks if the logged-in user is the manager of the record's employee
ACLs control read access based on conditions.
- C
Create a new view that excludes sensitive fields
Why wrong: Views don't enforce security; users could switch views.
- D
Create a Business Rule that deletes records if the user is not the manager
Why wrong: Business rules run on server and delete records, but don't prevent viewing.
- E
Use a Client Script to hide fields if the user is not the manager
Why wrong: Client scripts can be bypassed; server-side ACL is needed.