For example -- Currently the HR department members are configured for generic Technician accounts and are a part of the HR Support Group. As well they are categorizing requests under a HR Category etc..

This group contain the full scope of personal within HR -- admin assistants, HR Reps, Managers, Director, etc... --- who are all privy to certain employee data (This is also true for Finance or Security teams).

We could limit visibility to certain requests by assigning a Request to a specific Category (i.e: Salary Negotiations) and then applying access permissions to this Category to a smaller group of HR personal.

• We've thought about creating separate Support Groups and assigning permissions but it's harder to manage, would include additional training for every employee level (multiple workflow maps)
• Additionally it can generate dozens of extra Support Groups with limited use (i.e: Salary reviews happen once a year)

Also in some cases this private information is shared with members of other groups within the organization. For example: Employee Contract negotiations are a collaboration between HR and Finance etc. By having a Sub-Category (i.e.: Contract Negotiations) permission it's easier to manage access based on a process vs. having a ticket transfer between Support Groups (more room for error).