SD Security Settings

Summary Who can see which SDs? Members can always see down into the SDs embedded below the ones they're invited to, but never across to SDs at the same level or up to a parent. Global Search only finds SDs you've been invited to, though you can drill down to others in your downline. Each member is an Author or a Guest at each level, and the Block Embedded SD Drilldown setting restricts drilling down further.

Steps

Introduction. Understanding SD security is important, so you know what you should, and shouldn't, have access to. SD security is designed to prevent "sibling" SDs from accessing each other's information, not to block parent or grandparent SDs. Anyone can always view information down their SD lineage. The steps below use three users to show how it works.

Step 1

The examples use a family of seven SDs: - the Grandad SD at the top; - two parent SDs under it, Parent SD 1 and Parent SD 2; - two child SDs under each parent: Child SD 1 and Child SD 2 under Parent SD 1, and Child SD 3 and Child SD 4 under Parent SD 2.

Step 2

Three users have each been invited to different SDs in the family: - User 1: the Grandad SD, Parent SD 1, Child SD 1 and Child SD 2. - User 2: every SD except the Grandad SD. - User 3: Parent SD 2, Child SD 1 and Child SD 3.

What each user can see

Step 3

User 1 can drill down to any SD, because every SD is in their downline.

Step 4

In Global Search, User 1 can find Parent SD 1 and Child SD 1 and 2, but not the other SDs, because they were not invited to them.

Step 5

User 2 has been invited to everything except the Grandad SD. In Global Search, they can find every SD except the Grandad SD: they can't look up from Parent SD 1 or Parent SD 2.

Step 6

User 2 can also drill down from Parent SD 1 to Child SD 1 and 2, and from Parent SD 2 to Child SD 3 and 4.

Step 7

User 3 can see Parent SD 2, and Child SD 3 and Child SD 4 below it, because they are in their downline.

Step 8

In Global Search, User 3 can only find Parent SD 2, Child SD 1 and Child SD 3. They are not invited to Child SD 4, so they can't search for it, but they can drill down to it from Parent SD 2.

Step 9

User 3 can't look across from Parent SD 2 to Parent SD 1, because it is at the same level. They also can't look at the Grandad SD, because they can't look up.

The rules

Step 10

So SD members can always see down, into embedded SDs, but never across at the same level, or up. If you don't invite a member to a child SD, but they can reach it because it is below an SD they are in, two things happen.

Step 11

First, they won't be able to find the child SD in Global Search, because they are not invited to it. They can still find it by searching for the parent SD, then drilling down, if it is in their downline. Second, if they have Author rights in the parent SD and drill down to an SD they are not invited to, they don't carry their authoring rights with them: uninvited members are always treated as a guest.

Step 12

At each level where a member is invited, their member type, Author or Guest, must be specified. The default is Guest.

Blocking embedded SD drilldown

Step 13

The Block Embedded SD Drilldown tick box sits in the parent SD's panel, under the Archive SD and UnArchive SD buttons, with Update below it. Activating it alters the security: people can only drill down to an embedded child SD if they are the owner of the parent SD or a member of any SD above the parent. Even a member of the child SD can't drill down to it: they have to open it from Global Search, or from a link they have to the SD.

Step 14

For example, three SDs are linked in this order: Grandad SD, Parent SD, Child SD. With the drilldown blocked: - A member of the Parent SD who tries to open the Child SD from the Parent SD is blocked, unless they are the owner of the Parent SD or also a member of the Grandad SD. - A member of the Grandad SD can reach both the Parent SD and the Child SD, because they have ancestral privileges. They don't need to be a member of the Parent SD or the Child SD. - A member of the Parent SD who is also a member of the Child SD can still open the Child SD from Global Search, because they are a member of it.