There is other way than Security Policy to implement this use case. Here, I assume your document is draft only after creation (certainly a simplification against your use case), but you will have the idea to implement if the document goes back to draft, I let you do it:
Create an eventHandler for creation Event :
- Events : Document Created
- Document type : yourDocType
- Operation chain :
- Fetch Context Document
- User & Groups > Login As (let empty field)
- Document > Set ACL : ReadWrite / yourGroup / aNameOfYourChoice / grant checked
- Document > Set ACL : Everything / Everyone / aNameOfYourChoice / grant unchecked
- User & Groups > Logout
And create a second eventHandler for the transition
- Events : Lifecycle transition event
- Document type : yourDocType
- Operation chain :
- Fetch Context Document
- User & Groups > Login As (let empty field)
- Document > remove ACL : aNameOfYourChoice
- User & Groups > Logout
I think that's all. This is not the best implementation, I will suggest for a production server with a large volume of data a security policy. But this is fine for small/medium project.
