Control Center Question: Customize Profile Data vs Permissions & Sharing in a multi-tier setup?

amarks_hbs

Good morning,

I'm trying to understand how our Control Center setup is granting permissions and sharing. I've received conflicting information from multiple support sessions. The most recent response seems to match what we observed, but it introduced some concepts/terminology that I haven't seen in the documentation.

We are using a multi-tier setup:

• One Blueprint creates a Program workspace, with assets for the program created directly in that workspace.
• A second Blueprint creates Project assets inside folders within that workspace.
• We may have multiple projects within a program, each represented by its own folder.

Original Statement

In an earlier conversation with support, I was told:

The Customize Profile Data stage of the Blueprint assigns asset-level permissions, while the Permissions and Sharing stage assigns workspace-level permissions.

However, this did not match our observations. Asupport engineer later followed up with this explanation for our environment:

Multi-tier Behavior

Top/Parent Level Blueprint sharing permissions set within Customize Profile Data will share the entire workspace at the permissions set for the profile data point.
Second/Child Level Blueprint sharing permissions set within Customize Profile Data will share at the asset level at the permissions set for the profile data point.
This way they are not shared to the entire top-level project.

Questions

1. Is this explanation essentially saying that Customize Profile Data will apply workspace permissions if a new workspace is being created, but asset-level permissions if the workspace already exists?
2. If that is the case, does that mean asset-level permissions cannot be automatically applied to assets created directly within the program workspace?

Thanks for any clarification others can provide.

Adam

Thanuja kedila

When the top-tier blueprint runs and creates a new workspace, any sharing configured in Customize Profile Data gets applied at the workspace level — because that's the container being created
When the child-tier blueprint runs inside an already-existing workspace, it only creates assets/folders, so sharing in Customize Profile Data applies at the asset level

yes, that likely means assets created directly in the program workspace by the top-tier blueprint cannot receive asset-level permissions automatically. They inherit workspace permissions.

The best practical workaround would be to either move those assets into a folder provisioned by a child blueprint, or accept workspace-level permissions for them and manage exceptions manually.