Itil role can create a task, after save it is read-only

[rconstantino]

When a task is created by an itil user that can read/write the task form but as soon as that form is saved, it becomes read only.

I've looked at Business Rules, client scripts, and ACLs.

I believe this to be an ACL issue.

I have a create ACL on task.none which allows the ITIL role to create a new task.

I created a write ACL on task.number and assigned the ITIL role just to see if task.number became editable and it did not.

I've attached two screen shots - one as itil and one as admin on the same task.

What am I missing here?

Thank you in advance as help is always appreciated.

Best,

Rachel

[Nishant8]

Hello @rconstantino , As a quick check, could you please verify whether any deny unless write ACL exists? If so, try to assign the same role to ITIL user and verify?

Regards,

Nishant

[rconstantino]

@Nishant8 - checked for that; there are no deny unless write ACLs on the task table

[Lakshmi888888]

The behavior you described sounds more like a record-level write access issue than a field-level ACL issue. The task.none create ACL only controls record creation. Once the record is inserted, the user must also satisfy a write ACL on the Task table (or the child table if Task is extended).

Adding a write ACL on task.number will not help if the user cannot pass the underlying record-level write ACL (task.none, task.*, or a child-table equivalent).

I would recommend:

Impersonate the ITIL user.
Enable Debug Security Rules.
Open the saved task and look for any failing write ACLs.
Also check for UI Policies, Data Policies, or Client Scripts that make the form read-only after insert (!current.isNewRecord() scenarios are common).

One additional question: Is this a record directly on the Task table or on a table that extends Task (Incident, Change, Custom Task table, etc.)? That will help narrow down which ACLs are being evaluated.

[rconstantino]

@Lakshmi888888 - Thank you for the response.  I did enable debug security rules, etc and do not see a failing write ACL. I've checked BRs, client scripts, UI and Data Policies - nothing in there.

This record is directly on the task table.

The first ACL I created is a 'create' ACL.

I just created a 'write' ACL which resolved the issue

so...  what is the difference with a 'create' and a 'write'?