Gallery Permissions for a Shared Workflow Collection
A data team publishes 60 workflows to a Gallery collection used by three departments. Today everyone in the company has Viewer access to the collection, and Artisans in each department can edit any workflow. The security team requires that Department A cannot see Department B's workflows, that only the owning department can edit, and that a small central team can still administer everything. There are 3 departments (roughly 40, 25, and 15 users) plus 5 central admins. The Gallery uses AD groups, and each department already has an AD group. Workflows are currently all in one collection.
1. How should the collections and permissions be restructured to meet the separation requirement?
Read the worked answer
Split the single collection into per-department collections (or per-department sub-collections under a parent the central admins control). Grant each department's AD group Viewer (and, where appropriate, Artisan) access only to its own collection, and grant the central admins' group Curator/Admin access to all collections. Do not rely on Artisan role alone for edit rights; edit ability is scoped by collection permissions, so a department's Artisans must be granted edit on their own collection and not on others. Remove the company-wide Viewer grant on the shared collection, since that is what currently exposes everything to everyone. Verify that the central admin group has access to every collection so administration is not fragmented.
2. What subtle risks should be checked after the restructure?
Read the worked answer
Check: (1) workflows that reference shared macros, datasets, or other workflows across departments may break if the referenced asset is no longer visible to the running user; permission on the workflow does not grant permission on its dependencies. (2) Scheduled runs execute as the scheduling user or run-as account; if that account loses access to a collection or its dependencies, schedules fail silently. (3) Users who belonged to multiple AD groups may retain access through a group you forgot to remove from a collection. (4) The central admins' broad access should be intentional and audited, since Curator/Admin can see everything. (5) Test with a real Department A user that they cannot see Department B's collection, not just that they can see their own. Re-validate a sample of schedules after the change.