Incident Access Restriction Using ACL and Custom Roles

[Singhdeep70]

How do you allow a non-ITIL user to view all incidents, restrict confidential incidents to an elevated role using a table-level ACL, and switch their view from Self-Service to Service Desk?

[pr8172510 · Accepted solution]

Hi Singhdeep70,

You can achieve this using custom roles + table ACL + UI access control. 

---

1. Allow non-ITIL users to view incidents

• Create a role:

           incident_viewer

     Create Read ACL on Incident [incident]

• Operation: read
• Role: incident_viewer

 This gives read access without ITIL.

---

2. Restrict confidential incidents

• Create field:

u_confidential (True/False)

• Create table-level Read ACL (script):

answer = !current.u_confidential || gs.hasRole('x_confidential_access');

• Create role:

x_confidential_access

Result:

• Normal users → cannot see confidential records
• Elevated role → can see all

---

3. Switch from Self-Service to Service Desk

• Assign role:

sn_incident_read

 This automatically gives Agent/Service Desk view (no need for full ITIL)

OR

• Create a module pointing to Incident with Service Desk view

[pr8172510 · Accepted solution]

Hi Singhdeep70,

You can achieve this using custom roles + table ACL + UI access control. 

---

1. Allow non-ITIL users to view incidents

• Create a role:

           incident_viewer

     Create Read ACL on Incident [incident]

• Operation: read
• Role: incident_viewer

 This gives read access without ITIL.

---

2. Restrict confidential incidents

• Create field:

u_confidential (True/False)

• Create table-level Read ACL (script):

answer = !current.u_confidential || gs.hasRole('x_confidential_access');

• Create role:

x_confidential_access

Result:

• Normal users → cannot see confidential records
• Elevated role → can see all

---

3. Switch from Self-Service to Service Desk

• Assign role:

sn_incident_read

 This automatically gives Agent/Service Desk view (no need for full ITIL)

OR

• Create a module pointing to Incident with Service Desk view

[Ankur Bawiskar]

@Singhdeep70 

what do you mean by non-itil users?

End user who raise incident don't have itil role but still they can see the INCs from portal

what's your exact business requirement?

Remember you will have to make changes to Table level ACLs + Query BR on incident table

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[Vaibhav Chouhan]

You can achieve this by combining ACLs, roles, and role based view configuration.

• Give the non ITIL user read access to the Incident table through a custom role so they can see all incidents.
• Then create a table level or field level ACL with a condition or script to restrict confidential incidents, allowing access only to users with an elevated role. You can do it with a custom field like u_confidential, then create an ACL with condition or script like if confidential true then check for elevated role.
• For the UI, assign the required workspace or fulfiller roles to your custom role so the user gets access to the Service Desk or Workspace experience.

[Aditya_hublikar · Accepted solution]

Hello @Singhdeep70 ,

To show(read) non-itil user all record create new acl incident.none operation:read and role:non-itil(in my case here it is Role1) and add condition like confidential field is empty (in my case here it creator grp)

Created another acl for confidential records  where added condition like Confidential field is not empty (in my case i used creator grp field on basis of that im deciding to show that confidential record or not ) 

(if you want to allow only for security_admin remove itil role then from here)

Also updated incident query (ootb query br to see all records )

output :

For Role1

For security admin  & itil :

If this helps you then mark it as helpful and accept as solution.

Regards,

Aditya