Read time: 15 minutes

You made it to the series finale — congrats! 🎉 Your prize at the end of this is that everybody and their mothers are guaranteed to come to you for Change Job advice (personal experience 😆).

The big headline is that in the legacy framework (i.e., a world without Change Job templates), security access to fields in Change Job and its consolidated Change Org Assignments subprocess is primarily governed by domains 🔒

In contrast, in the new, template-based model, it’s controlled mainly via Configure Optional Fields (and some spilling over into a new, special tab under Maintain Functionality for Staffing Transactions).

We've seen some whack and half-baked advice out there. So we're here to set the record straight and give you all the accurate and important details you need to know.

In the legacy security framework, the fields in Change Job transactions are secured by 10 subdomains under the super domain Staffing Actions, with each subdomain granting view/modify rights to a specific set of fields.

For instance, access to the fields Job Profile and Job Title is controlled by the subdomain Staffing Actions: Job Profile.

For modern, template-based Change Job transactions, the subdomain Staffing Actions: Change Job Date and Reason controls access to all Change Job fields from a domain perspective, rendering the other 9 subdomains obsolete.

📝 Note: Access to Change Job web services and reporting fields continues to be provided through these Staffing Actions subdomains.

Access control for job change processes is taken over by the task Configure Optional Fields, enabling you to grant granular access for each individual field and completely replacing the retired domain-based field groupings.

Similar to Change Job, in the old model, access to org changes was granted through the 7 subdomains of the super domain Staffing Organizations.

In the new security framework, the subdomain Staffing Organizations: Header governs access to all organizations when Change Org Assignments is a consolidated subprocess of Change Job. The security config of the other 6 subdomains doesn’t apply in these cases. These access constraints need to be set up via Configure Optional Fields (Workday does for ya with the automatic conversion, which we detail here later).

⚠️ Note, however, that all these Staffing Organizations domains still drive security, even after the 2026R2 conversion, for Change Org Assignments transactions that are:

Good news! Here, you can rest easy because there are no changes! 🎉

The security of comp fields continues to be based on the subdomains under these 4 super domains:

No changes here, either; access to Assign Employee Collective Agreement processes continues to be granted through the single domain Worker Data: Collective Agreements.

Okay, time to say goodbye 👋 to domains and check out how exactly to Configure those oft-mentioned Optional Fields.