My company's audit department requires that no sensitive information (usernames, passwords, etc) is stored in the Confluence WIKI. As a sledgehammer approach to crack this particular walnut, they are requesting page level access entitlements being introduced across the whole WIKI to guard access to this kind of information. This is against the whole ethos of an open information store, providing knowledge to all.
I am looking for an approach that allows pages to be created/amended by a submitter (the maker), but not be visible (or available in the page change history) until the page has been approved by a second individual (the checker)? This would then make the checker accountable and reduce the likelihood of occurrence to a reasonable level, satisfying the audit viewpoint.
The use case would be something like this:
The maker edits/creates the page and saves it - at this point the page changes are hidden from both the current page and its history. The checker receives an email with the link to the amended/new page, so that the checker can review it.
The checker should have two options approval/reject the page. Approving the page will make it visible and added to the page's history; Rejecting the page allows the checker to add a comment on why it is rejected, and emails the maker with a link to the (still hidden page) with the comments.
The maker either receives an email indicating the page was accepted, or that it was rejected. If rejected, the email contains the link to the (hidden) page, allowing them to revise it and resubmit.
The checker should be the immediate line manager of the submitter, as identified from say LDAP.
I think the best way to do this that I can think would be to have a draft space where pages can be edited prior to being made live. The checked could watch the draft space and would receive notification whenever the make did something. Once they are approved you could either move the page to the appropriate space or copy the content if the page already exists.
Hi my Community friends! For those who don't know me, I'm a product marketer on the Confluence Cloud team - nice to meet you! For those of you who do, you know that I've been all up in your Co...
Connect with like-minded Atlassian users at free events near you!Find a group
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no AUG chapters near you at the moment.Start an AUG
You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs