403 - You do not have permissions to this page - UI Builder - Custom Workspace

[y-allen]

Hello.

I have created two custom workspaces for approvals in our ServiceNow instance, Xanadu patch 9. I am controlling access to the workspaces using a module entry where the module only appears for users in the respective groups.

Everything works correctly in the dev environment. However, pushing it to our test environment and impersonating the specific users, group 1 users are able to access the workspace for group 1. But group 2 is not able to access the workspace for group 2.

I have attempted to create various types of ACLs from the workspace settings page to ensure group 2 should have access to the workspace with no joy. I then removed all ACL's where no role is required to access the workspace, only the module. I also created an entirely new workspace, with no ACL's and no roles required to access it, but nothing is working for the second workspace.

Thanks in advance for any assistance.

[M Iftikhar · Accepted solution]

Hi @y-allen,

It sounds like the issue may be related to a difference in user access between the two groups rather than the workspace configuration itself, especially since group 1 users are able to access the workspace. I recommend using the Access Analyzer feature to compare the users from Group 1 and Group 2.

This comparison often reveals subtle differences such as missing roles or inherited access. Once identified, update the Group 2 users’ roles or group memberships and re-test workspace access.

If access still fails, verify that the Workspace access settings (ACLs, required roles, or UI restrictions) are consistent across environments and not being overridden.

If my response helped, please mark it as the accepted solution so others can benefit as well.

[y-allen]

Thank you for the information. I compared one of the users that could access their workspace and compared to a user that could not access the workspace. I noticed that the user that could was assigned the canvas_user role, while the user that could not access the workspace did not have that role.

However, I removed that role from workspace during creation but it appears that the role is still required somehow. In any case, thank you for your assistance.