HCL Notes 14.5 already provides the practical functionality to add another user's calendar to the personal calendar view. This makes it possible to display the colleague's availability in an overview alongside the user's own calendar.
However, when the calendar owner has granted free/busy access to everyone, but has not granted access to the mail file or calendar documents, the added calendar still causes an access violation to be reported on the Domino server. The user can see the free/busy information, but the Notes client apparently also attempts to access the user's calendar database or calendar documents.
This creates a confusing and undesirable situation:
The feature appears to work for the user, but the operation generates a security-related access violation on the server.
Administrators therefore have to tell users that they may use the functionality from a user-interface perspective, but that they must not use it because it produces security alarms or misleading access-violation entries on the server. This is difficult to explain and leads to uncertainty about whether the configuration is secure or supported.
Business use case
This functionality is particularly important for management support roles, executive assistants, board secretaries, and other coordination functions. These users often need a consolidated overview of when several managers or board members are available, without being allowed to read the details of their appointments.
The required permission model is deliberately restrictive:
Show only free/busy status.
Do not show appointment subjects, locations, participants, descriptions, or other details.
Do not grant access to the user's mail file.
Do not grant access to calendar documents.
Do not create access-violation or security-warning messages on the Domino server.
Requested enhancement
Provide a clearly supported Free/Busy-only calendar subscription or overlay in HCL Notes.
When a user adds another person's calendar using this option, the Notes client should request and display only the person's free/busy information through the existing Domino free-time service. It should not attempt to open the user's mail database, calendar views, or calendar documents.
The existing Add Calendar functionality could be extended with a distinct access mode, for example:
Alternatively, the current functionality could automatically detect that only free/busy access has been granted and use the free-time service without attempting document-level calendar access.
Security requirements
The enhancement should respect the existing free/busy permissions configured by the calendar owner and should not weaken database security.
In particular:
The free/busy-only mode must not require Reader access to the mail file.
It must not require the ACL privilege Read public documents.
It must not expose calendar documents or appointment details.
It must not grant access to mail, folders, contacts, to-do items, or private appointments.
It must not require public-access flags on mail-file views or calendar documents.
A denied or restricted free/busy request should return a clear client-side message without generating a misleading database access violation.
The server should distinguish a normal, authorized free/busy request from an unauthorized attempt to open the underlying mail database.
Expected behavior
If the calendar owner has configured:
Access to my schedule: Everyone – Only my availability
then another user should be able to add that person's calendar in free/busy-only mode and see an availability overview, for example as busy/free time blocks or an overlay.
The following actions should not occur:
An attempt to open the calendar owner's mail NSF as the requesting user.
An attempt to read calendar documents.
An access-violation entry caused solely by the free/busy-only display.
A requirement to grant Read public documents as a workaround.
If the calendar owner has granted calendar-reader or delegated calendar access, the existing calendar access behavior may continue to provide appointment details according to the granted permission. The new free/busy-only mode should remain available as the least-privileged option.
Benefits
Aligns the user interface with the actual permission model.
Prevents unnecessary security alarms and access-violation entries.
Supports the principle of least privilege.
Avoids the unsafe workaround of granting Read public documents.
Provides a reliable and understandable solution for executive assistants and board secretaries.
Reduces administrative effort and user confusion.
Makes the existing Notes 14.5 calendar overlay functionality suitable for production use in organizations with strict security requirements.
Acceptance criteria
The enhancement should be considered complete when all of the following conditions are met:
A user can add another person's calendar in free/busy-only mode when the owner permits free/busy access.
The resulting overview shows only availability information and no appointment details.
The requesting user does not need access to the owner's mail file or calendar documents.
The ACL privilege Read public documents is not required.
No access violation is generated on the Domino server as a result of the supported free/busy-only operation.
Private calendar entries and all appointment details remain protected.
The behavior is documented clearly in the HCL Notes and Domino product documentation.
The feature works consistently for calendars on the same server, across servers in the same Domino domain, and in clustered environments where the existing free-time architecture supports the request.
Additional consideration
The current behavior is especially problematic because the Notes client presents the calendar overlay as a legitimate supported action, while the server logs the related database access as a violation. A supported user-interface action should not require administrators to choose between misleading security alerts and granting broader access than intended.
A dedicated free/busy-only mode would resolve this mismatch while preserving the existing security model and providing a much clearer experience for both users and administrators.
