Security is applied to individual documents using document group security.
How document security works
A document can belong a document group.
Each user can be granted access to one or more document groups, and will be able to view documents that belong to those groups.
The paperclip button and the document browse respond to document group security.
If there are documents attached to a record, the paperclip button turns orange if the user has access under document group security to at least one of the documents.
If the user clicks the paperclip button, a document browse opens. The document browse will only list documents that belong to document groups that the user has permission to access.
If a document is attached to a record (for example, a purchase order or a supplier) the user must have access both to the record (determined by company security and contract security), and to the document (determined by document group security). If the user tries to view a document, but does not have permission, a message is displayed to inform them why they cannot view it.
When you move the mouse pointer over a document link, a thumbnail of the document appears. When you move the mouse pointer over the paperclip button, a thumbnail of the most recent document appears. If the user does not have access to view the document, the thumbnail currently shows an “image not available” icon.
Example of document security
In Document Group Security, user DONBAR has access to the group “001 - invoices” but not to the group “002 - payments”.
In Contract Security, the user does not have access to contract v7n.
The invoice record with internal reference 10060001 is costed to contract v7n, and has two documents attached – an invoice (belonging to document group “invoices”) and a payment (belonging to document group “payments”).
When user DONBAR runs the invoice enquiry, he can see the invoice record, and the orange paperclip button shows that there are documents attached. Because the most recent document is in the payments group (to which the user does not have access), the thumbnail shows an “image not available” icon.
When the user clicks the paperclip, although there are two documents attached to the record, the document browse only lists the invoice, because the user does not have access to the payments document group.
However, when the user tries to view the document, because he does not have access to the contract, he does not have permission to view it, and an error message is displayed.
To set up document group security for an individual user
Either:
In Company 0, go to Document Group Security.
By default, this displays a list of all current users.
Open the record for the user whose access you want to update.
or
In User Workbench, click the link for the user whose access you want to update.
From the Security tab menu, select Document Group Security.
In the Code field, enter a can-do list of codes for the document groups the user is allowed to access. * means the user has access to all document groups; blank means the user has access to no document groups.
Save the record.
To update document group security for multiple users
In Company 0, go to Update User DM Group Security.
Use the From, To and Matches fields to specify the users whose document group security you want to update.
In the Code field, enter a can-do list of codes for the document groups the users are allowed to access. * means the users have access to all document groups; blank means the users have access to no document groups.
Tick the Update User DM Group Security? box.
Click Next and answer Yes to the confirmation message.
You can use Update User DM Group Security to produce a report showing users’ current document management security settings, by running it with Update User DM Group Security? unticked.
Access to documents with no document group
Some documents may not have been assigned to document groups. The DM parameter BLANKGRP controls whether users can view these documents. Unexpected visibility behaviour — where users cannot view documents despite appearing to have the correct access — is most commonly caused by the interaction between BLANKGRP, document group assignments, and function permissions.
If BLANKGRP is set to Y, users will not be able to see any documents that do not have a document group assigned. (Note that although users will not be able to view documents with no document group, they may still be able to see the document listed in enquiries, and may be able to change the document group to one they have access to, effectively giving them access to the document.)
If BLANKGRP is set to N (or blank), all users will be able to see any document that does not have a document group assigned.
For documents that do have a document group assigned, document group security applies.
Troubleshoot document visibility issues
Use the checks below when users cannot view documents even though BLANKGRP appears to be configured correctly, or when document access is inconsistent between users with the same setup.
Documents are not visible despite BLANKGRP being blank
If BLANKGRP is blank (equivalent to N) but users still cannot view certain documents, the documents may have a document group assigned. Once a document belongs to a group, document group security applies regardless of the BLANKGRP setting. A blank BLANKGRP only grants open access to documents with no group at all.
To confirm this, check the document's group assignment directly. If a group is assigned, the user needs access to that group in Document Group Security to view the document.
⚠️Important: BLANKGRP does not override document group security. If a document has a group assigned, only users with explicit access to that group can view it, regardless of the BLANKGRP value.
Some users can view attachments but others cannot, with no document groups assigned
If no document groups are allocated to users and BLANKGRP is blank, all users should be able to view ungrouped documents. If some users still cannot view attachments, check the following.
Confirm the documents have no document group assigned. Open the document record and check the document group field is empty. If a group is present, the user needs access to that group.
Check the user's function permissions. Access to the paperclip button and document browse is controlled by function permissions as well as document group security. If the user lacks the required function access, they cannot open the document viewer even if they have document group access.
Confirm the user has access to the parent record. The user must have access to both the record the document is attached to (for example, a purchase order or supplier) and to the document itself. Contract security and company security apply to the parent record independently of document group security.
Documents are not printing — error SY091 'zero documents selected to print'
This error appears when the document selection process finds no documents the user is permitted to print. Work through the following checks.
Confirm the document has a group assigned. Open the document record and note the document group.
Confirm the user has access to that document group in Document Group Security.
If BLANKGRP is set to Y, confirm that all documents involved have a group assigned. Any document without a group will be excluded from the print selection when BLANKGRP is Y.
Check the document group security has been regenerated after any recent changes. In some cases, changes to document group assignments or user access do not take effect until the security is regenerated. Contact your system administrator if you are unsure whether a regeneration is required.
📌Note: If BLANKGRP is set to Y and some documents in a print run have no group assigned, those documents are excluded silently. This is the most common cause of SY091 when document group security appears to be set up correctly.