How Incident Records are Secured

The application secures incident records using the standard data security framework.

Any user other than the user with the EH Manager job role can access an incident record only when both these conditions are met:

• The user has the requisite environment health and safety privileges.

• The user has access to the specific incident record.

Access to Incidents

The EHS manager assigns a user as the incident owner for any incidents created by employees in employee self-service (when assignment rules are not active). When a professional user creates an incident, they can assign users to the incident by virtue of being the logged-in user. Users receive emails when assigned to or removed from an assignment on an incident. This security approach ensures that a user with an employee custom role having the relevant HNS privileges only can access incidents assigned to the user.

Action Management

An action owner, preapprover, approver, or reviewer can’t access the incident details, event, or investigation pages. They can only access the action record they are assigned to, if they have the requisite privilege.