Globally Enable/Disable Artisans to publish workflows to Home Page (My Company's Gallery)

[AnupD]

I work at a large organization where Security and Privacy are of utmost importance. The ideology that we need to follow is Least Privilege and Need to Know.

We (Curators) do not want all the Artisans to publish workflows to Home Page, either knowingly or unknowingly. We however do want to allow a few power users to publish their work in Home Page, but currently the Gallery does not provide the ability to pick and choose who can share workflows publicly. We are educating users to not share any contents publicly, but as we scale up, it will be difficult to manage and govern this.

I'm suggesting to implement a global Yes/No feature that will Enable/Disable Artisans to publish contents in Home Page (just like the way we have for Jobs/Scheduling feature). Further, in Users section, Edit User setting needs to have a Yes/No button that will allow Curators to let certain Artisans place workflows in My Company's Gallery.

Organizations that never want any workflow to be shared publicly can disable this feature using global Yes/No button. Organizations (like the one I work at) that want to enable this only for certain Artisans, can set the Global Yes/No to No, and then in Users tab, they can pick and choose the Users that need this functionality (which will override the global default). Finally Organizations that do not really care about this functionality can just set the global setting to Yes.

Hoping other organizations find value in this functionality as well. Thanks.

[mcglyne]

This is a problem for my organization as well. An accident waiting to happen.   All we need is for a HR artisan to accidentally post a PHI workflow in the public gallery and then we have a privacy incident.

[TanyaS]

As we review our permission vs role strategy, this kind of feedback is invaluable. Thank you for posting!

[piyush]

Any update on the status of this change?

[TanyaS]

Not yet. This request, should we do it, would not be handled individually, but as part of a bigger systemic change. As such, it requires careful evaluation.

Thanks,

Tanya

[jamielaird]

+1 for this feature. If anyone can suggest alternative ways to control/limit the ability for users to publish to My Company's Gallery please let me know.

[Emil_Kos]

Not sure if this is publicly available yet, but it definitely should be!

It sounds really simple to implement and at the same time, it can prevent leaking private data to users that shouldn't have access to view it. 

[gabrielvilella]

Please do this!

[yuriy]

+1 for this. There's no preventative measure at this point, which is huge concern especially since it is so easy to get it published by accident, and an email is sent to everyone. So by the time the workflow owner realizes that or admins notify them to remove it, someone else may already be browsing through the data. Looks like it has been requested at the beginning of 2019, and it is still under review. Please consider this as a potential data leak and prioritize accordingly. Thank you