Feature or Bug?: Any Supervisor now has access to all Employee and WorkAssignment ActionRequests (as

The October 2023 HR Talent CU brought updates to the GHRDirectSupervisor_ST and GHRIndirectSupervisor_ST security classes for which I can't find any mention in the HR Talent Release Report and that I'm trying to make sense of.

As written the change is very broad:

    ActionRequest BusinessClass
        is accessible
            for all inquiries, NotInProcess.UpdateParameters, InProcess.UpdateParameters, NotInProcess.View, InProcess.View,
                Rejected.ViewParameters, Complete.ViewParameters, Rejected.View, Complete.View
            when (BusinessClass = "Employee"
                or BusinessClass = "WorkAssignment")

There is no limitation that the Employee or WorkAssignment related-ActionRequest record be for someone they have a supervisory relationship to. It's literally anyone/everyone. The ParameterView field of ActionRequest contains all of the data for the request, which in the case of Employee and WorkAssignment is highly sensitive (plenty of PII, pay rates, in some cases banking details, etc.).

Why would every supervisor need both read access and the ability to update (potentially change??) the parameters for any in-flight Hire, Rehire, Terminate, ChangePayRate, or other similar action on these two business classes for people they do not supervise? (They could access it via the application's web UI, ISD, or via a REST URL.).

I wish my organization had a Pre-Prod tenant so I could have had an extra two weeks to figure out how to deal with this issue. I'm curious to hear how others in the community approach this.

Find more posts tagged with

Comments

Heidi Anderson

How did you discover this? Is there an incident with Infor?

Noe Ramos

i can't help but agree with you 100%. there is no mentioning of this specific update to the security class. it's as though someone added this last line of code and forgot to update documentation. i'm looking at the updated documentation from the zipped folder - HRTalent_Release_Docs_2023.10.03_en-us and looking at the document - TMSecurityDelta_2023.10.00.pdf

Noe Ramos

sorry for all the quick replies but i overlooked the mentioning because it didnt go into detail. it IS mentioned on the document and in my screenshot but all that's menioned is 'ActionRequest BusinessClass - NEW' but does not show the detailed LPL as it does with the changes.

however, i do feel Infor should post the lpl class configuration below that line of 'new' so we could easily see what exactly they are adding as that would be very helpful and we would not have to go takingn deep dives into coding to find what we are looking for.

Heidi Anderson

There was some concern from my organization too. On Monday, one of our HRIS analysts logged in as a test user and validated that our managers do not have add'l access that they shouldn't. We do not use delivered security roles - we make a copy and adjust (mostly removing broad access), and assign those copies to users.

sfrazier

I was wondering can i get more detail about where DirectSupervisor_ST are seeing the differences. We are still in implementation mode but want to comprehend more on what they saw before and where the differences are. Appreciate it.

cleverly

Before the October CU the DirectSupervisor_ST security class did not contain any rules related to the ActionRequest business class. The October CU added the rule (at the bottom of the security class) that I quoted in my original message in this thread.

You can view it by navigating (within GHR/HCM/HRT) to Security Administration > Standard Templates > Console > GHRDirectSupervisor_ST (and then scroll to the bottom).

A partial fix (JR-6548815) to somewhat close the barn door is (I'm told by support) coming in the December CU.

Copyright © 2025 Infor. All rights reserved.