---
category: [Administration & Integrations, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions, Platform and Product Extensions/Workday Extend, Platform and Product Extensions/Integration]
keyword: [Extend, Model Components, Model Domains, Security Domain, Extend Domains]
nav: wcp_docs
parent_url: /wcp_docs/
title: >- 
  Example: Securing Expense Type Transaction to Worker and Cost Center
layout: subsection
---

### Scenario

<a id="context_N1002A_N10027_N10001"></a>
This use case is for a business object that collects expenses. You need to set the `"secureByTarget": true` attribute on the Worker business object so you can route to the worker’s manager. However, the expense itself might be charged to the worker’s cost center or to another cost center based on the expense. You also need to set the `"secureByTarget": true` attribute on the Cost Center business object to route to the cost center manager.

<table><thead><tr><th>Worker</th><th>Cost Center</th></tr></thead><tbody><tr><td>John Chen</td><td>61100 IT Services Mgmt</td></tr></tbody></table><br/>

In this scenario, John attends a conference that might be paid for by their own cost center, or by another cost center they’re assisting with. A simplified representation of the transaction data is:

<table><thead><tr><th>Transaction ID</th><th>Worker</th><th>Cost Center</th></tr></thead><tbody><tr><td>1</td><td>John Chen</td><td>61100 IT Services Mgmt</td></tr><tr><td>2</td><td>John Chen</td><td>46100 HR Services</td></tr></tbody></table><br/>

<b>Note:</b> The second transaction is secured to a cost center that isn't part of John's organization structure.

### Result

<a id="result_N100D0_N10027_N10001"></a>
From a security perspective, if `Manager` is assigned to the security policy, John’s manager will see both transactions because both have security context to John through the Worker target business object.

However, if `Cost Center Manager` is assigned to the security policy, the cost center manager for the IT cost center would only see transaction 1 because only the IT cost center manager has security context to 61100 IT Services Mgmt through the Cost Center target business object.

This table displays the business process routing behavior, assuming that an approval is routed to the `Supervisory Manager` and then a separate step is routed to the `Cost Center Manager`:

<table><thead><tr><th>Transaction</th><th>Business Process Routing</th></tr></thead><tbody><tr><td>1</td><td>Step 1 (Supervisory Manager): Route to John’s Manager.</td></tr><tr><td>1</td><td>Step 2 (Cost Center Manager): Route to the Cost Center Manager of IT.</td></tr><tr><td>2</td><td>Step 1 (Supervisory Manager): Route to John’s Manager.</td></tr><tr><td>2</td><td>Step 2 (Cost Center Manager): Route to Cost Center Manager of IT and HR. If either cost center manager approves, it will move on from the cost center manager approval step.</td></tr></tbody></table><br/>

The term <i>aggregated security</i> makes sense when you review this business process behavior. The business process routing includes the security context for all fields of the business object for which you specify a security context (that is, set the `secureByTarget` attribute to `true`).

### Related Information

[Security Evaluation with Multiple Targets](/wcp_docs/nvi1682534801207.html)