Does anyone use RM 'Lists of Values' or 'Supplemental Markings'?

[resplin]

Supplemental Markings can be used to implement a security clearance type of functionality, and Lists of Values are used to manage the list of Supplemental Markings and Transfer Locations. The small amount of documentation about these features are here:

http://docs.alfresco.com/rm2.3/concepts/rm-lov-intro.html

We aren't very happy with how these features are implemented. We want to make it more obvious how to manage Transfer Locations, and we want to take an entirely different approach to managing security clearance markups. Our new implementation of security clearances will be a proprietary solution tailored at specific national requirements.

The Alfresco Records Management module will continue to be the free open source core upon which we build these proprietary solutions, in the same way that Enterprise Edition is derived from Community Edition. We want the Community Records Management module to continue to be useful in the scenarios where we already know it is being used. I don't know of anyone using this feature, which is why it seems reasonable for us to rethink the implementation.

Are you using this feature?
What is your use case?
How would it impact you if we removed this functionality?
Would you be willing to help maintain it as an open source module?
What extension points would you need us to implement for you to build your own solution?

I look forward to your feedback.

[riddelln]

Hi, I don't currently use these.  However given that we expect to be implementing RM in the future in the UK it would be good to get an understanding of how you plan to implement Supplemental Markings as these are typically used as part of a security policy in addition to normal ACLs. As I'm sure you're aware in very secure environments these rules can get complex and also need to be honoured by search too.

Niall 

[rwetherall]

Hi Niall,

Security marks, which is our general term for "list of values" or "supplemental markings", work in compliment to ACLs.

They provide a mechanism to both mark content and provide security clearances to users.  When a user has sufficient clearance relative to contents marks, then the normal ACLs are evaluated, otherwise read access to the content is vetoed.

The evaluation of the security marks happens at the lowest level possible within the permission service.  This ensures they are applied to all interactions with repository content, including search. 

If you are interested in the detail, we have introduced the notion of permission pre and post processors whose implementation can be "sprung" in to append additional logic around the regular ACL evaluation.  Hopefully you will see this generally useful extension point make it's way into the core product in time.

I hope this answers your questions?

Cheers,
Roy

[steven_okennedy]

Hi Richard,

Are these changes part of broader changes in the RM approach/feature set or is it isolated specifically towards security clearance markup, LOVs & transfer locations? 

I'm just asking because there's one area where I think Alfresco is currently falling down with the RM implementation.  I think the approach to records management in Alfresco and how the segregation between record users and record managers is excellent, giving the flexibility of record declaration anywhere with in-place filing but still allowing central administration of records by record managers. It's much better than what I've seen in other products and coupled with the rules engine for auto-filing can significantly reduce the effort for managing records

The main problem I have is that in Alfresco the concept that document retention and out of the box management of that is deemed to be a "record-only" feature.  In my opinion, there are a large number of scenarios where you have documents that are not organisational records, but that would benefit greatly from having retention, review or decollation schedules applied, either because they are short lived or because they are likely to be obsolete.  These files might not have any restriction on them around having to remain static while they are stored (like records do) but that doesn't mean that it won't be extremely useful to users across the whole organisation to be able to automatically manage (or be reminded of) clean up tasks to keep things in order in the repository.

I'm not suggesting that this functionality should have to be added to the core Alfresco product (although that is one option), it could quite happily remain in the Records Management module but offer a variant of the retention schedule type functionality for general documents as well as for formal records.  I believe that this was also called out in the recent Forrester Wave for ECM this year, so I don't think I'm the only one seeing a lack here. 

Please feel free to contact me on this, if you want to talk further on this

Thanks

Steven

[rwetherall]

Hi Steven,

Thanks for the feedback, we always appreciate it.

I think your evaluation is accurate and something we have identified within the RM product development team as a direction we want to move in.

As a general rule of thumb you will start to see core compliance features, although still delivered within the RM module, starting to apply across all content not just records.  We see this as a much more powerful and useful approach moving forwards.

With specific reference to the application of simple retention, archival or destruction policies to documents, the best I can say at this point is that it is both on the product and architectural road-map.  This combined with better workflow integration, via Activiti, and our current approach to in-place filling and rules will, we believe, give us a very unique and useful product.

Cheers,
Roy

[steven_okennedy]

Thanks Roy,

That's good to hear.  I saw the way the new Security Classifications stuff will work which is exactly the sort of approach I was hoping for

Regards

Steven