Open Source Document Management System | OpenKM

We are designing workflows for specific requirements, and we are looking for some advice.

Here's the idea:

To OKM, the user loads a folder filled with files. This folder will go through many manual and automated steps.
For example, this folder is made available to a group of users, one of which 'takes' the folder to review it. During this time, no other user should touch (or see) this folder.
Later, this user will be done with this folder, and will change its status (i.e. changing metadata folderStatus="QA-Checked"). After doing so, this folder will not be visible to any user, except to cron.
Then a cron job will regularly pick up folders with such a statuses, and perform some checks (code), and change the status to something else once done with the folder.

The question is: How to hide this folder from others when one user (or cron) is using it?

1. Change folder security: One possible solution is to keep changing the folder security, back and forth, anytime one user takes it (or cron takes it)

2. Change folder location: Another solution is, instead of changing security on the folder being processed, just move this folder different folders with set securities i.e. when the user takes the folder to process, it will be moved to a folder where only the user has access to it (through security). When user gets done with the folder, it's placed in a folder where only cron has access to it

3... another method?

Any ideas on which approach we can take to implement such workflows, with the least impact on the server?

Thank you all.

I suggest security change ( remove all security grants -> or save in some extra table before removing to recovering later ). From crontab task you might use systemToken ( super user ) which will have grants for watching everything. In addition of security change, you can also lock the documents into the folder ( in this scenario you have an extra security, because docs are locked, extra mark and extra step, modifying by mistake in this scenario is quite strange. Take in mind lock and unlock must be done by the same user, or forced by super user. ).