Taking ownership and execution of a task

[bgl]

Hi,

Next to my previous thread about assigning a task to a group and to David's answer, I have a new question (http://forums.alfresco.com/viewtopic.php?t=7823)

I've played around with the feature of pooled task, group task and so on. Here is my scenario: I have a group for writing, one for reviewing and one for approving.
Since the pooled task and group task are only available out-of-the-box for the approve/review workflow, I use this.
I have 3 users: A, B, C. A is not part of reviewing nor approving (he is part of writing group). B and C are part of reviewing and approving.

On a content written by A, I start a review/approve workflow. I choose a pooled review/approve. Reviewers are Reviewing groups.

I disconnect and re-connect with each user to check their dashboard. Dashboard exposes any panel related to tasks. Those from review are seeing the task with no ownership. In "All Active Tasks", everyone see the task.
One from Review group takes the ownership (let's say B). Then C can see the task in "All Active tasks" (and A can do so).
But the problem I see is that A (who is not part of this group) can take the ownership of this task and execute it if he wants…which can be a huge problem. I agree that C can take back the task because he is part of the group -may be a reason for taking back ownership would be a good idea, for instance B is on holiday- but I cannot imagine that A can take it.

And in fact this is also possible for task assigned to a user. Another can take it from the "All Active Tasks" panel and execute it.

This leads to a more general question: is it possible to manage some "security" on tasks ?

Thank you

[davidc]

The "All Tasks" dashlet should not be used for general purpose as there's no security around it yet.  So, I recommend not including that dashlet in the dashboard (or configuring it out completely, so it's not available to choose).

[jdbrown]

David, is it possible to only expose the "All Tasks" dashlet as an option in the dashboard for a specific role or specific user?   Even if we could force this into a specific user's dashboard and not expose at all as a dashboard option?  For example, to only allow the admin role access to this dashlet?

[davidc]

Unfortunately, the Alfresco dashboard doesn't yet support role based dashlets. I'm sure I've heard that someone provided this capability as a contribution - anyone know of this?