Design Question

[Jason Fenter]

I have an application that keeps some internal auditing data: what was done, when it was done, and who did it. Unfortunately, my users typically open the app and log in, then leave it open all day. Several users may use the application without signing in under their own name, and so the auditing data is flawed.

The nature of the application lends itself to needing to be open and running at all times. (It dispenses drugs from a hospital pharmacy.) Because of that, I'm not sure that I want to put a timeout in it. Another thought was to have the users identify themselves every time they filled an order. Even if that were as simple as scanning a bar code, it would still be quite tedious.

Does anyone have any other thoughts on how to address this issue?

[Dan Cooperstock]

I think you really don't have many choices. Either you make them identify themselves for every order, or you compromize on an agreed-upon timeout, where if the program has been inactive for that long, they have to identify themselves again.

The 2nd solution, of course, is still susceptible to problems, if people are (say) lined up to use the app, so they are using it immediately one after the other.

Basically at this point I think it's a business decision for your stakeholders (hate that word, but it applies here!) to make, as to how important it is to have perfectly correct auditing, versus how annoying it is to have to log in for every action.