How to remove "Add CI Relationship" button based on permissions?

[UKRCmadams]

Hi there,

We currently have a situation where users with the service_editor role are able to modify CI relationships on the CMDB. I have locked this down using create and write ACLs on the cmdb_rel_ci table.

While this does work, the "Add CI Relationship" button is still visible on the form, which takes users to the relationship manager screen. The only way you can tell it didn't work, is because the changes are not saved.

Ideally, I want to get rid of this button if you do not have the rights to use it. I saw a thread (albeit posted 13 years ago) stating that modifying the ACL should be enough, but it doesn't seem to be now.

Any ideas?

[VivekSattanatha · Accepted solution]

Hi,

ACL is enough! we still control it by ACL. If they have at least table-level write access also then that button would be visible. For testing give the ACL a higher role

Regards,

Vivek

[mikkojuola]

Hi Vivek,

What if you would want these same people to maintain CI Relationships in a different way (and in different place), but not via this "Related Items" element?

Cheers,

--Mikko

[VivekSattanatha]

Hi,

Then you need to build your own catalog item to add the relationship and then it will be created in system context without ACL involvement.

What you ask is not possible because the related items ui macro is OOB controlled by Servicenow we dont have access to change it.

Regards,

Vivek

[mikkojuola]

OK, thanks.

I was just wondering since we have our own app in the Store that can be used to create CI relationships. But that still respects the ACLs and some of our customers would like to disable using the OOB Related Items and only use our app for maintaining agreed relationships.

Cheers,

--Mikko