ACL Script Not Granting Create/Edit Access for Group or Role on a Table

[Deepika Mishra]

I'm working on configuring ACLs for the contract_rel_ci table in my instance. The requirement is:

Users who either have the contract_manager role OR are part of the "Portfolio Manager" group should be able to create and read records in this table.

---

What I’ve Done So Far:

I’ve created the following ACLs (all with Advanced checked and the same script):

1. Record ACL – contract_rel_ci – create
2. Record ACL – contract_rel_ci – read
3. Record ACL – contract_rel_ci.* – read
4. Record ACL – contract_rel_ci.* – write

All ACLs use this script:

var answer = getAnswer();
answer;

function getAnswer() {
    gs.info("ACL Check: Starting group check for user: " + gs.getUserName());

    // sys_id of the "Portfolio Manager" group
    var portfolioManagerGroupId = "passing group sys_id";

    var groupIds = gs.getUser().getMyGroups();
    if (!groupIds || groupIds.length === 0) {
        return false;
    }

    if (groupIds.indexOf(portfolioManagerGroupId) !== -1) {
        return true;
    }
    return false;
}

only for contract_rel_ci.*  write operation using below script:

var answer = getAnswer();
answer;

function getAnswer() {
    var portfolioManagerGroupId = "passing group sys_id";

    // Allow if user has the contract_manager role
    if (gs.hasRole("contract_manager")) {
        return true;
    }

    // Allow if user is in the Portfolio Manager group
    var m2m = new GlideRecord("sys_user_grmember");
    m2m.addQuery("user", gs.getUserID());
    m2m.addQuery("group", portfolioManagerGroupId);
    m2m.query();

    return m2m.hasNext();
}

---

What’s Happening:

• Users with only the contract_manager role: ❌ Cannot create or edit records.
• Users in only the Portfolio Manager group: ❌ Cannot create or edit records.
• If I reactivate the old ACL that only checks for contract_manager role (no script), it works — but then Portfolio Manager group users are still blocked.
• I’ve confirmed:
  • No UI Policies, Client Scripts, or Business Rules are interfering.
  • Fields are not marked read-only in the dictionary.

---

What I Need Help With:

• Is there something wrong with the script logic or ACL ?
• Why does the scripted ACL fail when the role-based one works?
• Is there a better way to allow access for either a role or a group?

Any help or insights would be greatly appreciated!

[Ankur Bawiskar]

@Deepika Mishra 

update script such that answer variable is set with true/false

answer = getAnswer();

function getAnswer() {
    gs.info("ACL Check: Starting group check for user: " + gs.getUserName());

    // sys_id of the "Portfolio Manager" group
    var portfolioManagerGroupId = "passing group sys_id";

    var groupIds = gs.getUser().getMyGroups();
    if (!groupIds || groupIds.length === 0) {
        return false;
    }

    if (groupIds.indexOf(portfolioManagerGroupId) !== -1) {
        return true;
    }
    return false;
}

Did you use access analyzer to debug?

[Vancouver Release] Customers gain enhanced access visibility with ServiceNow Access Analyzer 

If my response helped please mark it correct and close the thread so that it benefits future readers.

[Deepika Mishra]

It is not working even though I am trying below code. It is working for contract_manager but not for portfolio one

var answer = getAnswer();

function getAnswer() {

    var portfolioManagerGroupId = "prtfolioGroupSYSID";

    // Check if user has the contract_manager role
     if (gs.hasRole("contract_manager")) {
         return true;
     }

    // Check if user is in the Portfolio Manager group
    var grMemember = new GlideRecord('sys_user_grmember');
    grMemember.addQuery('user', gs.getUserID());
    grMemember.addQuery('group', portfolioManagerGroupId);
    grMemember.query();
    if (grMemember.next()) {
        return true;
    }

    return false;
}

[Anirudha Bhanda · Accepted solution]

There might be a none write access missing for Portfolio Managers Group. That is my assumption.