Incidents should be see only the group

[AnilM99]

Hi Team, 
I have one critical requirement:

I have 3 groups: HR-A, HR-B, and HR-C, and one parent group, HR-Parent.

1. If incidents are assigned to the HR-A group, HR-A group members only should see those incidents. Same as the remaining groups also. But the HR-parent group should see all the child group tickets and parent group tickets also; child group members should not see the parent group ticket and other group tickets.

2. HR-Parent group should see only HR-Parent and child group tickets, not other group like SN-ServiceDesk and other groups

3. Other group members Must NOT see HR-related tickets

4. If I opened the HR incidents, I want to see those incidents.

5. ITIL and admins also should not see the HR-related incidents except when they are in the caller.

6. Current functionality for ITIL and admin users should continue the same. except the HR-Related incidents

Thanks

Anil

[Its_Azar]

Hi there @AnilM99 

You can do this via a record-level READ ACL on the Incident table. 

that's the best way to do this, i guess. Before Query BR can help with lists, but ACLs are mandatory to enforce security across forms, lists, APIs, reports, and impersonation.

(function () {

    var userId = gs.getUserID();

    if (current.caller_id == userId || current.opened_by == userId) {
        return true;
    }

    if (!current.assignment_group) {
        return false;
    }

    var ag = current.assignment_group;

    var isHRGroup = ag.name.startsWith('HR');

    if (!isHRGroup) {
        return true;
    }

    var user = gs.getUser();
    var userGroups = user.getMyGroups();

    if (user.isMemberOf(ag.sys_id)) {
        return true;
    }

    if (ag.parent && user.isMemberOf(ag.parent.sys_id)) {
        return true;
    }

    if (!ag.parent && ag.name == 'HR-Parent' && user.isMemberOf(ag.sys_id)) {
        return true;
    }

    return false;

})();