ACL and ITIL issue

[aggarwaltan]

Hi Team,

I have created an email account to establish the connection between ServiceNow and Outlook.

Additionally, I have created an Assignment Group and set its type to ITIL. I have also created the required role, associated the application with the role, and created a custom application for the respective users.

After that, I also created an ACL for the Read operation. I specified the required role and condition and added the following script:

answer = gs.getUser().isMemberOf('current.assignment_group');

I also created another ACL to allow users with the specified user profile to view all the tickets.

However, the user is still unable to view the tickets. I checked and found that the Ticket table is a child table of the Task table, so I provided the ITIL role to the user.

After assigning the ITIL role, the user is also able to view Incidents, which is not the intended behavior.

Should I modify or remove the two ACLs that I created and instead create a separate ACL to restrict the user to viewing only the required INC records?

Please suggest the best approach for implementing this access restriction.

Note :- After ITIL user can able to work all custom application work which I have created then how we proceed for stopping further things like INC and Task . 

[Brad Bowman]

Your original ACL is failing because there is not a group named 'current.assignment_group'. Change this to 

answer = gs.getUser().isMemberOf(current.assignment_group);

[aggarwaltan]

So, without giving the ITIL role, will this work?

[Brad Bowman]

With all the customization you'll have to try it to see.  The ACL is definitely one thing that needs fixed, but there may be something else.  It doesn't sound like granting the user the ITIL role is the right approach, since you don't want them to inherit ITIL permissions like viewing incidents.

[aggarwaltan]

So I give the ITIL Access to the user, but make a restriction for them so that they can't access the INC. list from ServiceNow, and it works after that.