How does everyone manage their access requirements to NDA or Sensitive Processes, would like to compare notes 😊

I would say there are basically two strategies here:

1. Separate models and object definitions

Keep the sensitive models in one folder with restricted read access, and keep the object definitions in another folder that remains visible to the wider audience.

In this setup, users will not see the sensitive models themselves, but they can still see and reuse the relevant object definitions, for example, roles, positions, systems, etc., in other process models.

2. Filters/method configuration

The second approach is using filters. In most cases, this is used either to hide specific model types or, more often, to hide certain object types or attributes.

For example, this may be relevant for risks, DoA / delegation of authority objects, KPI values, financial values, salary-related information, and so on.

Hello.

We also used just an additional database in which we created such drafts.
For us this was more secure and we don't grant access to the secret folder by mistake (e.g. pass on privileges to users via the main group). 

From here we are able the merge the models in the normal database when those drafts are ready to be shared.

Kind regards,
Florian