How do I control who can view and edit incident reports?
Use Read, Read Own and Edit Own, Areas and field permissions to control incident access, and fix staff seeing everyone's incidents.
Key Points
Who can see and edit incident reports is controlled by the permissions on the incident Section and Form, and by Areas.
Read lets a Group see every incident. Read Own lets them see only the incidents they lodged.
Edit Own lets staff update their own reports after saving them.
If a staff member can see everyone's incidents, one of their Groups usually has Read access, often through the default all Group.
You can hide parts of a report, such as a management-only section, with field permissions.
How access is decided
FlowLogic checks access in this order:
Area: staff only see incidents in Areas they have access to.
Section and Form permissions for each of their Groups: Read, Read Own, Edit, Edit Own and Add.
Field permissions: which Groups can read or change individual fields.
Record access: changes made on one record with the shield icon.
If someone is in more than one Group, their permissions are combined. A deny always wins over an allow.
Common setups
| Who | Permissions | What they can do |
|---|---|---|
| Support workers | Add, Read Own, Edit Own | Lodge incidents, see and update only their own. |
| Team leaders and managers | Add, Read, Edit | See and update all incidents in their Areas. |
| Office or compliance staff | Add, Read, Edit, plus the management-only fields | Review, investigate and close incidents. |
Changing incident permissions
Go to System Menu > Sections and open Incident / Accident / Near Miss.
Open the Forms tab and expand the incident Form.
Edit the permissions for each Group. Use Add New Access Rule to add a Read Own or Edit Own rule.
Remove the all Group if it gives everyone Read access.
Save.
The incident tables on client and staff records use the same permissions as the main incident Form. See How do I set permissions on Sections and Forms?
A staff member can see everyone's incidents
Check these in order:
Does any of their Groups, including all, have Read rather than Read Own on the incident Form?
Are they in more than one Group? Permissions from every Group are combined.
Has someone given them access on individual records with the shield icon?
A staff member can't see an incident
Check they have access to the incident's Area on their user profile.
Check their Group has Read, or Read Own if they lodged it.
What isn't possible
You can't limit staff to the incidents of the clients they support. Access is by Group, Area and who lodged the report.
Read Own can't be set on individual fields.