Published at: 2026-09-17
Approve temporary permissions
Configure temporary process authorization so handlers can access Business Data during approval tasks and Business Process execution.
Overview
💡 If a handler lacks record access at the system level, the handler cannot view the business record and the approval is blocked. Temporary permission rules grant the handler temporary read-only or read/write access when a task is created, then revoke it after the process advances or finishes.
Before you begin
[!IMPORTANT] - Role permissions: You need System Administrator permissions or a management role with Data Permissions Management permissions. - Timing: * A temporary permission rule applies only to new process instances created after the rule is configured and enabled. * It does not apply to historical pending tasks that reached a node before you enabled the rule. * After you disable a rule, the system immediately revokes all unfinished temporary permissions granted by that rule.
Procedure
1. Configure a temporary authorization rule
- Go to CRM Platform Management > Data Permission.
- Open the Temporary Permission tab, select the rule list, and click New temporary permission rule.
- Configure the rule:
- Applicable object: Select the business object, such as
ContractorRefund Request. - Permission start time: Trigger authorization when the task reaches the current handler.
- Permission revocation time: Keep authorization for a defined period, such as 30 days, or revoke it when the task or approval ends.
- Permission type: Grant Read Only or Read/Write access to the current record.
- Applicable object: Select the business object, such as
- Click Confirm to save the rule.
2. Revoke or monitor temporary permissions manually
- On Temporary Permissions, click Authorized List to view active permissions.
- The list includes the authorized person, record, authorization start time, and end time.
- Select a record and click Revoke. The employee immediately loses visibility of the record.
## Considerations- Security and compliance: Plan standard department data permissions and sharing rules first. Minimize reliance on temporary authorization rules to preserve auditability.
Verify the result
- Configure a Contract rule to grant read-only access during an approval task.
- Sign in as finance employee A, who has no Contract data access.
- Submit a test contract and assign A to the approval node.
- Expected result: The contract appears in A’s To-Do Center, and A can open its details.
- Have A approve the task so the process advances.
- Expected result: The task disappears from A’s To-Do Center. Searching for the contract again shows that A has no access after approval ends.