Sharepoint Item Level Access & performance

Question

i have created a workflow activity that do give the item creater of a specific list full control on the item and set everyone else to read only access (permission)

someone told me that doing it this way (if i have a lot of users) the performance will go down dramatically

is that correct ?!!

if yes what is the best solution to create a list where any one can create new items but after the item is created only the creater can edit it and the rest of the users can read it only

Answer 1

Yes, you might solve this with workflows but that might be a bit clumsy and it might slow your server.

The better option is to use List Settings > Advanced Settings > Item-level Permissions.

This feature is not available for Document and Form Libraries.

Answer 2

Performance degradation will happen when you use large ACLs for each list item. Just make sure that item-level permissions basically have the minimum entries. For example:

• The user that has permissions to edit that item
• A single security group that contains all the users with only Reader permissions.

So, can Sharepoint offer these default permissions OOB? Not that I'm aware of. The only option that I can think of is using workflows that set these permissions dinamycally when the document is uploaded.

If you want to avoid performance degradation just make sure that you never display (or iterate using the object model) more than 2000 of those items in a Fine Grained Permissions list. THAT would definitely cause major performance issues.

Answer 3

It is true that a list that contains a large number of items with custom permissions applied, will slown down your server. This is document in the official Microsoft paper Plan for software boundaries.

The recommended/magic number is 2000. Going further won't break anything, but it could be that you will run into performance issues.

Answer 4

The accepted answer is not actually answering the question correctly...

You should not use a workflow to do this, if you want people to be able to edit items they create and only read ones they did not, use "List->Settings->Advanced Settings->Item-level Permissions", and this is available for document libraries (since they inherit from SPLIST) it just does not show up in their "Advanced Settings" in the UI. You can set the ReadSecurity property to 1 and the WriteSecurity property to 2 on the Document Library.

http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.splist.writesecurity.aspx