Assigning Read Permissions dictated by Cross-reference value

[wellis23661]

Hi all, I have a bit of a tricky problem, I need to set up a system within an Assessment application that controls user read permissions based on their department. Departments are only represented as records and linked to users through cross-references on their contact records. The system or custom object should compare the department on an Assessment record with the department linked to the viewing user’s contact record. If they match, the user is granted read access; otherwise, access is denied. I am cautious about using a record permissions field due to potential performance issues with assigning many users per record. As I said, its quite a tricky and unique situation, but just seeing what ideas are out there.
**Groups to represent Departments are also out of scope at the moment.

Happy to elaborate further to clear any confusion.

Thanks!

[dmerrick_256]

@wellis23661  It might take some prep work but you can try the following:

1) Add a RP field on the Contact record that only grants the Read permission. Tie that to the Contact's Archer User ID.

2) Add a calculated X-Ref to Contacts on the Assessment record that compares the department field on the assessment record to the department field on the Contact records. *If you can't find a matching field you may need to add a calculated text field on both apps that captures the Department info. 

3) Add an IRP field on the Assessment record that is based on the calculated X-Ref.

I use this combination quite a bit both for automating RPs and to set Role-based permissions. And no need for a CO.