Background / Problem
Shared Calculations provide reusable calculation logic across workbooks connected to the same dataset or subject area. As their number grows, authors lack a scalable way to organize them, and sharing can expose calculations too broadly to users who can access the associated dataset or subject area. This makes calculations difficult to find and prevents selective sharing of sensitive, specialized, or work-in-progress logic.
As a calculation creator or authorized administrator, I want to organize Shared Calculations into folders and assign an ACL to each
calculation so that users can quickly find relevant calculations while only discovering and reusing calculations they are authorized to access.
Two Interdependent Enhancements
- Folders with ACLs: Allow authorized users to create, rename, move, and delete folders and organize Shared Calculations within them. Folders provide navigation, categorization, and an administrative scope for managing large collections.
- Calculation-level ACLs: Allow users, groups, and application roles to be granted access to an individual Shared Calculation. The ACL remains the authoritative security boundary, regardless of folder placement.
Together, folders make governed collections understandable and manageable, while ACLs ensure that access to a subject areas does not
imply access. Users see only permitted calculations and the folder pathsneeded to reach them.
Useful Scenarios
- Finance catalog: Finance organizes calculations into Revenue, Margin, and Forecast folders, while ACLs restrict sensitive margin and forecast logic to finance roles.
- Department collections: HR, Sales, and Operations use separate folders within a shared enterprise subject area. Users see only calculations permitted by their individual ACLs.
- Regional governance: Regional folders simplify discovery, while calculation ACLs restrict region-specific or regulated definitions to appropriate roles without duplicating the subject area.
4.ACLs at the folder level to control the group of objects and ACL at the shared object level for more control if needed.
