ACL not working as expected

[ChrisWing]

I have a requirement for a specific catalog item to restrict the ability to update Assignment Group.  I have built a ACL to this effect that unless it is a ServiceNow Admin the field will be read only. In the conditions it says it will affect the appropriate number of records, however in practice it is affecting other catalog items as well.  What did I do wrong?

By saying the ServiceNow Admins have write access that implies the rest of the people do not, and the data condition should restrict it to the one catalog item correct?

[Dhruv Chandan]

Hi Chris,

Was a script initially created within the ACL and subsequently removed by deselecting the "Advanced" option? This has previously led to some confusion for me as well.

If yes, please remove that script completely and then uncheck the advance option.

Hope this helps.

Thanks,

Dhruv

[ChrisWing]

Inside the screenshot the Advanced button isn't checked, so I flipped it on and the script is still empty, turned it back off.  That isn't the culprit here.

[Brad Bowman]

Can you confirm that when this ACL is deactivated, non-admins can update the Assignment group field on Catalog Task records related to this Catalog Item and others?  Then once you activate the ACL, are you seeing that no users can update the Assignment group field on any Catalog Task?  Try adding admin to the Requires Role and removing the Security Attribute Condition.  Also check to see if you have other write ACLs on this field.

[ChrisWing]

So interestingly if I remove the ACL it is still restricted.

I went into production and checked and the field is not Read Only, I can not see any other recently ACLs that would be applied to that field but looking in the Access Control list isn't easy.  Is there a different way to see all the ACLs applied to a particular field coming from the form?