We just rolled out new security labels and it took 6 hours for first issues to appear. Perhaps I need to dial back some of the configuration. We added a new label that has restrictions requiring an agreement to allow access. In testing we found that creators could set the label value to one of the restricted values and poof, the document would disappear on them since they would not have access. I guess same is true for sync robots and set state robots.
A user was creating a change notice and set the security label to that restricted value. This caused ALL set state robots to abort when executing since that change notice was not accessible. From what I know, the state change causes sync robots that are listening to be checked and this CN was inaccessible due to that restricted value. wcadmin is part of the group that can see all values so it should not have been restricted. Does this mean the workflow was executing as the creator user? Possibly. Sure enough when I fixed the security label to make it unrestricted, it all started working again. I need to tighten this up quickly before more users make this boo boo.
