A recruitment submission should identify the candidate record, vacancy, information version and the authorised sharing decision under the agency’s process. Keep employer responses and follow-up tasks linked to that submission. Limit access to unnecessary personal details, and preserve withdrawn or corrected information so staff do not repeatedly share an outdated record from a general candidate folder.
- A candidate record and an employer submission are different.
- Track the information version actually shared.
- Withdrawal and correction need assigned follow-up.
Separate the candidate from individual submissions
One candidate may be considered for several vacancies, but each employer submission has its own context. Record candidate reference, vacancy, employer contact and submission owner. Avoid using a single global candidate stage to represent every employer conversation at once.
Maintain the relevant information version and the source of updates. A revised experience summary or contact preference should not quietly alter the record of what was previously shared. Staff need to understand the difference between the current candidate record and an earlier submission.
Define the authorised sharing process
The agency’s responsible personnel should determine what sharing instructions and permissions are required for its process. Record the relevant decision and scope before a submission. Do not interpret a stored CV or an answered phone call as universal permission to send every detail to every employer.
This is operational guidance, not legal advice on consent or employment obligations. Qualified personnel must determine the agency’s applicable requirements. The workflow should preserve their decisions and make unresolved sharing questions visible to staff rather than invent a legal conclusion from a checkbox.
Limit sensitive information by role and purpose
Vacancy users often need the submission reference, relevant experience and next action, not the candidate’s entire administrative record. Restrict unrelated details and attachments. Review employer-facing exports carefully, because a broad download can reveal fields that the internal vacancy screen intentionally hides.
Use references and necessary information in task titles and notifications. Avoid copying personal narratives into pipeline comments for convenience. If staff need to discuss a sensitive matter, follow the agency’s established access and communication procedures with a clearly assigned owner.
Illustrative scenario: a candidate updates a shared record
Imagine a candidate corrects a document after it has been submitted for two vacancies. The recruiter records the new version and identifies the affected submissions. Each submission owner follows the agency’s authorised update process, rather than assuming that changing the central file updated both employers.
Responses and follow-up acknowledgements remain linked to their individual submissions. This illustrative scenario addresses information versions and responsibility; it does not determine consent validity, employment rights or an employer’s obligations for a real candidate or jurisdiction.
Handle withdrawal as a traceable action
A withdrawn consideration or sharing instruction needs a submission-level state and responsible follow-up. Preserve the relevant record under the agency’s established retention process while preventing casual reuse of an outdated active flag. Distinguish withdrawn from rejected or completed consideration.
Record what was communicated and which employer response remains outstanding. A recruiter should not repeatedly resubmit the same candidate simply because the general database still contains their document. Review unresolved withdrawal and correction tasks alongside ordinary interview follow-up.
Evaluate version and permission boundaries
Ask a demonstrator to submit one candidate to two vacancies, correct the shared document and withdraw one consideration. Inspect the vacancy account and an export. The workflow should preserve individual submission history and restrict fields unrelated to that user’s task.
EasyManageX listings are illustrative. Confirm candidate references, sharing decisions and access boundaries with fictional records. A small pilot can establish whether recruiters reliably identify the version and scope of each submission before the agency imports its existing candidate files.
Your working checklist
- Create identifiers for candidate and submission records.
- Track vacancy-specific submission owners.
- Record authorised sharing scope and information version.
- Restrict sensitive fields in exports and notifications.
- Distinguish withdrawal from rejection.
- Test a correction across two employer submissions.
Common questions
Does a stored CV permit every employer submission?+
Do not let the workflow assume that outcome. The agency’s responsible qualified personnel should define applicable sharing requirements and decisions. Record the relevant scope and unresolved questions, so recruiters act through the authorised process rather than infer blanket permission from the existence of a document.
How should updated information reach previous submissions?+
Identify the affected submission records and assign the appropriate follow-up under the agency’s process. Preserve what was originally shared and the corrected version. Changing the central candidate file alone does not prove that an employer received or acknowledged the updated information.
What should a vacancy pipeline expose?+
Show information needed for that vacancy’s authorised work, with appropriate access to supporting details. Keep unrelated sensitive fields restricted and test downloads and notifications. Submission reference, responsible owner and next action can make the pipeline useful without exposing the complete candidate administration record.
Sources and further reading
These primary references explain relevant concepts. Our scenarios and working checklists are original, illustrative guidance.
- OWASP Authorization Cheat Sheet
Access-control principles for limiting candidate information by role and purpose; this does not determine consent or employment obligations.
- OWASP Logging Cheat Sheet
Further reading on preserving meaningful event history while excluding sensitive information from routine logs.
Published by EasyManageX as practical, AI-assisted guidance. Examples are illustrative. Confirm software capabilities, licence terms and project-specific requirements before committing. Read our editorial policy.
