Q:In v11 there is a Security Setting of Document - Invalidate which applies to all Documents. How do I give Invalidate Note privileges to a user without allowing them to invalidate all Documents?

To allow a user to invalidate a note in v11 without allowing them to invalidate all document types, you need to do two things. Please note, that although this is an example of "invalidating a note", this same technique applies to all users and document types.

Security Setting (TWAdmin / Security Admin)

First, give the user the Security Setting of "Document-Invalidate".

User Finalization Authority Level and Document Type Finalization Authority level (TWAdmin / User Admin) (TWAdmin / Dictionaries / Document Type)

Next, in order for a user to access, invalidate, etc… a document type, you need to make sure the users Finalization Authority Level is set the same or higher than the Document Type Finalization Authority Level.

The same goes for Document Types you do not want the user to access; make sure their Finalization Authority Level is lower than the Document Type Finalization Authority Level. Note that there is also a security gate of "document invalidate without finalization authority". If this gate is left unlocked and users have the same security code in their security classification group, they will still be able to invalidate notes that they don't have proper finalization authority on. To prevent this, remove the code or make sure the gate is locked.