#item-level-security 4 articles

• A count over a ReadSecurity 2 list is only the reader's share — and the bit that says "sees everything" is Manage Lists alonegotchas / permissionsItem-level read security filters rows silently, so a client-side count or ranking is the reader's own rows; show it only with ReadSecurity = 1 or Manage Lists in the reader's mask, and don't also demand Override List…
• A drop box for sensitive files — a document library can't do it, a list with ReadSecurity 2 and attachments can (measured, including the direct attachment URL)gotchas / permissionsGiving someone write access to a protected library folder also lets them read every file in it; a list with ReadSecurity = 2, Contribute for the senders and Edit for the reviewers lets people send files they alone can…
• An "add what's missing" permission sync turns every change of owner into a leak — the previous owner keeps accessgotchas / permissionsIdempotent grant-only re-sync is safe at item creation but not when an item moves to another customer or team — the old group stays on the item; remove by principal Id, keep a protected set, and verify with a second…
• Manage Lists lets you read other people's items on a WriteSecurity 2 list, but not edit them — that takes Override List Behaviorsgotchas / permissionsOn a list with item-level write security, the Edit role (Manage Lists) still gets 403 when it updates an item someone else created; only a role with Override List Behaviors (CancelCheckout, Low 0x100) gets through, so…