Bible Translation work takes place in a variety of Social and Political contexts. While we would like to share as much as possible with Staff, Investors, and Users, we first need to focus on mitigating the risk to those who are doing translation work. Depending on the Sensitivity of a Project, we restrict access to specific data by role.

Levels of Sensitivity

There are 3 levels of Sensitivity: High, Medium, and Low.

Assigning Sensitivity

Sensitivity is assigned to Languages and Projects.

Languages

Administrators assign the Sensitivity to a Language.

Projects

When a Project is created the Sensitivity is defaulted to High. The Sensitivity can then be set lower.

Translation Project

Translation Projects have their Sensitivity automatically set based on the most Sensitive Language engaged.

Internship Project

Internship Projects have their Sensitivity manually set by the Project Manager.

Sensitivity Considerations

Some roles are restricted from accessing Sensitive information regardless of the Sensitivity level. Other roles are restricted based on the Sensitivity level of a Language or Project.

Whenever possible we should display the Sensitivity of an entity or its related entity.

Whenever possible we should use a non-sensitive field as the primary field (e.g. Language Display Name vs Language Ethnologue Name) and provide users with access to the Sensitive field a way to view that additional information.

Sensitive information may not be visible to a specific user. How this is handled should be carefully considered.

Sensitive Fields

Table of specifics for each field and the level of restrictions can be found: https://docs.google.com/spreadsheets/d/1GBAyYtzztRGgdIJY44XI27obITYCEDkxY_mLk9IS4jE/edit#gid=1963028748

Example: Budget

universalTemplateFile and records are a sensitive field(s). Global Access to these fields for a specific role (as of now, the global ConsultantManager role) is limited to Medium, meaning a user with that role can see universalTemplateFile and properties of the records (amount, fiscalYear, and organization) in Medium and Low sensitivity contexts, but not High sensitivity contexts.

Implementation

Translation Project

1. Create a Translation Project, assign a universal template file to the budget
2. Register a user and assign the ConsultantManager role
3. Create a Partner and Partnership, making them a managed and funded partner/partnership, and assign a date spanning at least a year.
4. Since the ConsultantManager only has access if the project's sensitivity is Medium or Low, and the Project is by default at High Sensitivity, a signed-in ConsultantManager user should only see empty rows for those funded years, as well as seeing no evidence of a Universal Template file.
5. As an admin (or some user with the correct permissions) Create a language with Medium or Low sensitivity, and create a language engagement on that translation project
6. When signed in as the ConsultantManager, user should be able to see the rows and data for each Budget Record, as well as the universal template file.

Intern Project Pretty much the same concept as Translation Project only you can set the sensitivity on the project manually ...

Role Assignment Checklist (relevant to devs)

The following is for programmatically setting a role and making the determination for whether a sensitivity to role mapping should be used for a component.

Global roles

• A. Are any props readable? set canList: true
• B. Are all props unreadable? set canList: false
• C. Are all props set to a certain sensitivity (not blank or < 'High')? set sensitivityAccess: {sensitivity value}

Project roles

• 1. Are any props readable? set canList: true
• 2. Are all props unreadable? set canList: false
• 3. Are all props set to a certain sensitivity (not blank or < 'High')? set sensitivityAccess: {sensitivity value}

getListRoleSensitivityMapping

• Is C true for any of the roles? call getListRoleSensitivityMapping({COMPONENT}, 'global') when canList is true
• Is 3 true for any of the roles? call getListRoleSensitivityMapping({COMPONENT}, 'project') when canList is false
• Is C and 3 true for any of the roles? Call global and project for when canList is true, and only call for project when canList is false.