InfoPath Dev

HI,

I'm evaluating InfoPath2007 for the organisation I work for and have a couple of questions.

1. In non-browser compatible forms the InfoPath application must be installed on the user's PC for them to open the form.  This also gives them the ability to edit both the form and the accompanying XML data. A unscrupulous manager could, for instance, receive a holiday request form and change the number of days before approving it. Likewise technically minded employees may believe they have a better way of doing something and edit the XSN file and unknowingly break it messing up the workflow.  Apart from putting digital signatures on everything is there any way to combat this?

2. Given 1. why was it not implemented like PDF forms where users have readers that enable them to open and fill out  a form but only the original developer would have the full capability to modify it in other ways.

Hey good questions.

This is a classic social issue that I won't delve into.

In a paperbased world, people can use whiteout or alter forms or create copies etc.

Or using other office apps you have little control of the form.

With InfoPath you have the ability to add validation and limit what people can do.

The template must be published and the resulting documents are set to use that template from the published location and in the same access method.

You can put permissions on the template and allow everyone to read but only those with permission have the rights to edit or change the template file.

At the end it is just data and can be possibly altered but I think you have more protections then the alternatives.

I am not sure if you have worked with Adobe's forms but they are not as powerful or flexible.

In the case of 1 if they break it they break it. And other policies and practices are in place to catch people who lie, cheat, and alter documents.

For 2 secure the template. it is required to render the data and can be protected from altering.

Thank you Clay, that's an interesting and useful response. Do you have any advice about what the best way to secure forms would be? e.g. digital signatures or just permission restrictions or some combination of these.

 thanks,

Mark