Workbench Access per Page about az_quickstart

[danahertzberg]

Thanks Ashley! This is in line with some feedback I just received. The better intention on this is to create an "Editing Teams" taxonomy vocabulary so netIDs are not in any public format.

[akslay]

You can restrict pages not in the menu if you use a taxonomy scheme instead of a menu scheme.

We also encountered issues where Workbench Access only works if you add the page to the menu using the "include menu link" checkbox from the node edit page, rather than through Structure > Menu. So instead of making editors manually change that for every page on the site, we opted for the taxonomy approach on our site too. Especially since taxonomy can be bulk applied from the Content overview page.

We did not automate creation of taxonomy terms based on NetID, though, so this might not even be relevant to what you're requesting; but, in general, it is possible to restrict pages not in the menu.

However, I think automatically creating taxonomy terms based on editors' NetIDs could potentially be a security and/or PII concern? Taxonomy pages are public by default, so it could potentially expose login usernames if visitors land on a taxonomy term page (/taxonomy-list/taxonomy-term). And on the PII side of things, it might need to be an opt-in selection on a per-user basis; otherwise we'd also potentially be exposing editors to unsolicited contact/requests/etc., since their NetID also ties in to their email address (especially since that info is also no longer "public" on directory.arizona.edu either, and requires a login to view).

I can't remember if those taxonomy pages are set to not be crawled/indexed by Google or not, but unless the site has disabled those views or walled them off to editors only, they are reachable by anonymous users. Worst case, though, someone would have to get through CAS even if they were able to obtain a username via the taxonomy page.

Using something like Rabbit Hole to wall off a specific taxonomy list and its terms to editors/admins only might get you around both of these concerns, though?

[danahertzberg]

Make taxonomy vocabulary "team" scoped rather than netID scoped

[danahertzberg]

See arizona.edu for example