Security Keywords and multiple user groups what are the effects of some having keywords and some not?

[Peter_Scaramuzz]

I am setting up a dashboard for a user and I have it configured so that it respects security keywords. However in our testing the user is telling me she is seeing documents that her security settings should not allow her to see. The user has multiple user groups assigned to her. I noticed some have security keywords and some do not. Is it possible that the user groups that are in her profile that have no configured security keywords are allowing her to see everything? I did ask her if she can confirm that she can also see these same documents when searching and I am still waiting to here back. However she seems to be confident these are documents that she normally wouldn't be allowed to see.

Our group who manages the system seem to be locked out of a lot of documents even though we have the manager user group so we always try to log in as an manager when troubleshooting things. Can the security keywords settings in user groups conflict with each other and cause unpredictable results perhaps?

[Eric_Beavers]

The expected behavior is that Security Keywords are MOST restrictive. If a user is in any group with a security keyword, it should be applied no matter what other groups the user has membership to.

About the only times I have seen unpredictable behavior is when EQUALS and NOT EQUALS clauses are mixed. This usually results in nothing being able to be retrieved at all.

[Peter_Scaramuzz]

Appreciate the info! What happens if a user is given access to 2 usergroups? One has no security keywords and the other has a security keyword of department = abc. Does the user group with no keywords give that user access to all departments? Or (it sounds like) you are saying they would be restricted to department abc and the other user group without configured keywords ignored? If the latter is then correct what else could be causing them to see the other departments?

BTW, the way that Hyland set up the security keywords is with embedded ones in user groups that are assigned to the user. I am just noticing that keywords can be set at the user level which is not something that we configure/use.