A role-based unconstrained security group is not limited by an organizational, requisition, or role-assignment constraint. If the group has access to the Find Candidates report and the underlying candidate domains, the report can return all candidates within the tenant data accessible through those domains.

Option A describes behavior more consistent with a constrained recruiting role whose access is limited to assigned job requisitions. The Background Check stage does not constrain an unconstrained group merely because the role’s business purpose includes background checks. Referral source is also not an automatic security boundary.

This is a critical security-design distinction. A role’s descriptive purpose does not limit access; the security-group type, domain permissions, and constraints do. Linking the new role to an unconstrained group can provide substantially broader candidate access than intended, including sensitive application, assessment, and background-check information. If access should be limited to assigned requisitions, a constrained group and appropriate role assignments should be used. Study Guide reference: Configure Recruiting Security — Role-Based Unconstrained Security Groups, Find Candidates, Candidate Domains, and Constrained Versus Unconstrained Access . Workday emphasizes use of its core security model to support candidate management and regulatory requirements. Workday Recruiting datasheet

===============