automation & page permission restrictions

[chris sieverts]

hello community!

we have automation in place to capture comment activity in Confluence however we are having an issue where that automation is failing because "Rule actor does not have permission to view page." In Jira we can tie the automation to the user doing the posting/action but don't see that as an option in Confluence.

Has anyone else come across this issue & how did you solve it?

Thank you!

[Tomislav Tobijas]

Hi @chris sieverts ,

Here are a couple of feature requests related to the topic:

• CONFCLOUD-80002: Add the ability to change the rule actor in Confluence Automation 
• CONFCLOUD-76428: Suggestion to add a service user called "Automation for Confluence" 
• CONFCLOUD-81227: Add 'User who triggered the event' as an Automation Actor 

No official workarounds are listed, but you could check the comments and see if anyone stumbled upon a worthy solution/'fix' 👀

Cheers,
Tobi

[chris sieverts]

Thank you. I was tracking two of those but not the 3rd. Unfortunately I don't see any workarounds so for now we've removed the ability of our users to apply restrictions. it is frustrating that the functionality exists in Jira to use the actor who triggers the event but Confluence does not have that. 

[Arkadiusz Wroblewski]

Hello @chris sieverts 

that is one of the main differences compared to Jira.

In Confluence automation, the rule runs as the rule actor / rule owner, and there is no equivalent to run as the user who triggered the action like you have in Jira.

So if the rule says "Rule actor does not have permission to view page", the usual fix is to make sure that the rule actor has access to those restricted pages.

You should check who owns the rule, whether that user can open the affected page manually or there are page restrictions overriding normal space access.

So basically, the workaround is not changing to the posting user, but making sure the rule actor has the required page permissions.

[chris sieverts]

thank you. yes, the challenge is "making sure the rule actor has the required page permissions" and that is not something that we can be proactive with. for now we have removed users ability to apply restrictions.

[Arkadiusz Wroblewski]

@chris sieverts 

Yes i will say, that are also some form of Solution for your Problem.

[Barbara Szczesniak]

@chris sieverts What are you doing with the comments gathered by the automation? Who will see them?

Have you looked into the pages that fail? Pages are restricted for a reason known to the restrictor (not ready for wider use, contains personal/personnel/financial data or plans to sell the company 😉, etc.). If the rule actor doesn't have access, maybe it's because they shouldn't. 

[chris sieverts]

we are a financial company and therefore regulated. comments fall under communications and as such are captured so they can be reviewed as part of the regulatory audits.

Yes, we began looking at the failures which is how we discovered this issue. We've provided guidance to the users that they leverage the page status feature to note if the content is in draft mode, review, etc. as our environment is pretty much used by technology for delivering projects, there is a low chance that anything shouldn't be shared but should that situation arise, we'll come up with some workaround, i.e. use an actor that does have access for the automation.