Workflow history can show different aspects of the workflows. The problem comes when filtering for users that are not assigned for that workflow or any workflow. So, we have the following situation:

· User A has a workflow assigned

· User B does not have any workflow assigned

· User B can see the workflows escalated or delegated to User A (and any other user in any other company)

In terms of restricting the information available, this is not working as expected. Everybody can view purchase orders, invoices and travel expenses that should not be viewed. The user should view only those records where the user itself is involved.