How restrict records access based on group?

Alberto18 · ‎03-11-2020

We have this requirement where we are to restrict records based on the group a user is a member of. Say we have Group A, Group B, and Group C. We want Group A to full access to records. Group B and Group C should only be accessing records assigned to their group.

What is the best approach to achieve this? Thank you!

Tanaji Patil · ‎03-19-2020

I think this script is overcomplicated becuase-

You only need this restriction for Group B and Group C; so its better to add these conditions in Condition field instead.
Don't miss to replace the group names in the conditions.
You just need one line in the script. I showed 2 options in the code; both works.
Script will show them only tickets assigned to their groups.

Could you please try following BR?

When: Before
Query: True
Condition: gs.getSession().isInteractive() && (gs.getUser().isMemberOf("Group B Name") || gs.getUser().isMemberOf("Group B Name")

Script:
// Copied from list view; works perfectlky fine
// Assignment group is (dynamic) One of My Groups
current.addEncodedQuery("assignment_groupDYNAMICd6435e965f510100a9ad2572f2b47744");

// Could also use following line if like
//current.addQuery("assignment_group","IN",gs.getUser().getMyGroups().toArray().join(","));

-Tanaji

Please mark response correct/hrlpful if applicable

View solution in original post

Jags5 · ‎03-11-2020

Normally you can ACL on fields and the CRUD is determined as per the ACL defined.

If you want to work with data in records, you could add custom condition in Condition Script of ACL.

Please mark reply as Helpful/Correct, if applicable. Thanks!

Sarup Paul · ‎04-21-2020

Always recommended from SN to use ACLs in place of BRs. Performance is usually better with ACLs and makes the troubleshooting much easier

Jags5 · ‎03-11-2020

https://community.servicenow.com/community?id=community_question&sys_id=925b8721db9cdbc01dcaf3231f96...

I found another thread with similar question. Go through.

Please mark reply as Helpful/Correct, if applicable. Thanks!

Tanaji Patil · ‎03-11-2020

Best practise says you should use ACLS but I saw before query used more often as ACL leaves security constraint thingy which is quite annoying.

Write before query BR on task table with proper conditions. If it's only for specific table then add it on that particular table.

-Tanaji

Please mark response correct/helpful if applicable