1. HR Profile security — who can see what?
“A manager opens an HR case and can read the subject's home address. Compliance is unhappy. How is HR Profile access controlled?”
How to answer
- sn_hr_core_profile is the sensitive table — never grant public read.
- Access is governed by HR Security roles (sn_hr_core.basic, .manager, .admin) PLUS scoped ACLs on individual profile fields (SSN, address, DOB).
- The HR Profile record uses a Before-Query business rule to filter by employee relationship (subject, manager chain, HR agent assignment).
- Case-level 'confidentiality' flags hide entire cases from non-HR users, even ones with a read role.
Reference script
// Field-level ACL on sn_hr_core_profile.home_address
// Condition script:
answer = gs.hasRole('sn_hr_core.admin') ||
gs.hasRole('sn_hr_core.manager') &&
current.user.manager == gs.getUserID();Pitfall
Granting sn_hr_core.manager broadly. The role gates the UI, but the row filter still needs a manager-chain check — without it, any manager sees every profile.