Locking Workflows

New Contributor

Would anyone be willing to share how they are locking data to end users, but still allowing consolidation users to make adjustments?

When implementing OneStream, we created workflows for users to load trial balance data, complete forms and load journals. We also created a “Corporate_Consol” workflow where we the Consolidation users could load journals after the workflows were locked. We figured out that if the top month for the workflow was not locked, but the workflow channels under were locked, users could still submit data in OneStream using Excel forms. Now we are locking the months under each workflow to avoid user changes. This makes it hard when we have post close adjustments to book in the “Corporate_Consol” workflow, as we have to unlock each of the workflow months where there is an adjustment needed for an entity in the workflow.

Thank you for any help/input!


New Contributor III


This may help. If the users are not inputting journals, you can set Adj for the user Workflows to Workflow Name = Central Journal Input which will enable entering journals on Corporate_Consol when the user Workflows are locked.


Thank you Terry. Users are also inputting journals in most workflows.

New Contributor III

If this is a really strong need, then you can look into using a separate UD members for the “normal” users and corporate, and then put different workflow channels on the UDs and workflows. That way you can lock the standard channel but keep the “corporate” channel open for forms input/adjustments. The only caveat to using this is that it can get very confusing to end users and even consultants 



 if not properly documented and used in a limited way. Workflow channels are very nuanced, so you’ll need to really look at the design and reference guide and architect it out, then prove it out and make sure you don’t miss anything.

Hope that helps!


we had the same issue and just created topside entities. This allowed us to lock their working entities and still give corp the ability to add adjustments where needed. Our design has all adj’s coming at the regional level so there was no need to put to an individual entity. Works for us.

Contributor III


We have a ConsolAdj channel under each sub's workflow so we can lock the ADJ channel (and import and forms) but leave the month open and the consolidations team can still post JEs to those entities from their own ConsolidationAdmin.ConsolAdj channel. It's effectively locked for topsides for the sub but still open for consolidations. 
Here's how the sub's WF channel is set up: 



And for consolidations: 


From a user perspective, they don't see anything different on the workflow because they don't have access to that channel: 


Hope that helps! Let me know if you have any questions. 



Further explanation - we've narrowed down forms security (via Application > Cubes > Data Access tab > Data Cell Conditional Input section) so users are only able to load forms data to very specific intersections for actuals. As a result, we generally don't worry about locking the month to prevent forms loads which is something that might be a bigger issue for you and my ConsolAdj suggestion above likely won't resolve. 

In addition to leaving the month unlocked for the Sub's Workflow for Conso adj, how do you manage the Certification step of the Sub ? Is the Sub only certifying their Workflow once Conso finished making adjustments ?

Yes, certification is done only once everyone has completed all their activities for the month.