A knowledge base holds articles that only staff in the Finance department should be able to open, and those staff hold no roles beyond the ones every logged in user receives. Which mechanism governs who is allowed to read the articles in that knowledge base?
- AA user criteria record matching the Finance department, added to the Can Read list of that knowledge base Correct
- BA role added to the knowledge base record, granted to each Finance user through their group membership
- CA read access control rule on the knowledge article table whose condition matches the department of the current user
- DA category inside the knowledge base named Finance, with the articles filed under it for the department
Why A is correct: User criteria evaluate attributes such as department, group, location, company and role, and the Can Read list on a knowledge base is exactly where read audience is declared.
Why B is wrong: Roles are the familiar way to gate most platform features, so reaching for one is tempting, but knowledge read access is evaluated through user criteria rather than a role field on the knowledge base.
Why C is wrong: Access control rules do protect the table generally, but the per knowledge base audience for articles is decided by user criteria, so writing a rule here duplicates and fights the supported mechanism.
Why D is wrong: Categories organise articles for browsing and searching, which feels like structure equals security, but a category carries no audience and hides nothing from anyone.