Time Off Request problem ----------- MOSS 2007, SharePoint Designer, Server 2003

[nmon...@dssinc.com]

Hi all,

I have built a TOR (Time Off Request) site with several workflows as a
company wide solution for requests of all types with SharePoint
Designer. I started with the MS template 'Absence Request and Vacation
Schedule Management'. Here is how it works basically:
1) user submits a request and this kicks off the first workflow
2) an email is sent to both the requester and approver
a. Approvers are in a separate list by employee name
b. One two possible approvers and each listed by AD name not groups
c. Email has link to the list item and some info from the request
embedded via html
3) A second workflow handles the gathering of the Approve/Deny answer
(this was part of the template so I didn’t change it)
4) Approver can then approve/deny and make comments
a. Email confirmation is sent to the approver and to the requester
b. Requester can make changes to all/any fields
i. Changes will revert status back to pending
ii. Another email will send to requester and approver
5) This process can be repeated endless times until the date of the
scheduled leave
That’s the basics of the workflows but the issue comes in with HR. My
company has several departments and HR says that none in the company
should be able to see anyone else’s request (they are pulled to
another calendar later by Bamboo). So the permissions are:
Read Access: Only their own
Edit Access: Only their own
The approvers are also employees that need to submit to their boss as
well. Approvers can have no permissions that will allow them to see
other departments but they need to be able to get into and approve the
request. As far as I can find Manage Hierarchy is the lowest level of
permissions that will allow the approver to get into the original
request; but it also lets them into all requests.
There seems to be no way to add a folder to try to group the requests
by department so I can do permissions on the folder. I downloaded
http://spdactivities.codeplex.com/ and used the Grant Permission on
Item(- Allows granting of specified permission level on a specified
item) to give the approver (can only use 1 name and no groups and this
didn’t work with the approvers list so it does now require several
‘if’s based on employee department) but even though I gave the
approver ‘Full Control’ they still could not get into their employee’s
request. I need some ideas and help. I have tried to use the ‘Delete
List Item Permission Assigment - Allows deleting of specified
permission level assignment for a given user’ but I couldn’t get it to
work. It probably won’t work anyway for two reasons, 1)it’s not
practical to delete all users one at a time and 2)it won’t work on
group, only individuals.

Started looking into controlling the views and the ability to control
view creation
Looking into a way to make some columns appear on a permission basis

And I found some stuff on CodePlex but I don’t have the luxury of a
test environment so I must be extremely careful with what I install.
Plus in the not so distant future we may be migrating to a different
SharePoint platform like 2010 or Enterprise 2007. So what I do now may
have to be viable in those environments.

HELP PLEASE!