Itil role can create a task, after save it is read-only

rconstantino · 3 weeks ago

When a task is created by an itil user that can read/write the task form but as soon as that form is saved, it becomes read only.

I've looked at Business Rules, client scripts, and ACLs.

I believe this to be an ACL issue.

I have a create ACL on task.none which allows the ITIL role to create a new task.

I created a write ACL on task.number and assigned the ITIL role just to see if task.number became editable and it did not.

I've attached two screen shots - one as itil and one as admin on the same task.

What am I missing here?

Thank you in advance as help is always appreciated.

Best,

Rachel

Lakshmi888888 · 3 weeks ago

The behavior you described sounds more like a record-level write access issue than a field-level ACL issue. The task.none create ACL only controls record creation. Once the record is inserted, the user must also satisfy a write ACL on the Task table (or the child table if Task is extended).

Adding a write ACL on task.number will not help if the user cannot pass the underlying record-level write ACL (task.none, task.*, or a child-table equivalent).

I would recommend:

Impersonate the ITIL user.
Enable Debug Security Rules.
Open the saved task and look for any failing write ACLs.
Also check for UI Policies, Data Policies, or Client Scripts that make the form read-only after insert (!current.isNewRecord() scenarios are common).

One additional question: Is this a record directly on the Task table or on a table that extends Task (Incident, Change, Custom Task table, etc.)? That will help narrow down which ACLs are being evaluated.

Please mark this response as Helpful or Correct if it helped.

View solution in original post

Tanushree Maiti · 3 weeks ago

Hi @rconstantino

Create ACL : Allows inserting a brand-new record into your mentioned table.

Write ACL: Allows updating, editing, or modifying data in a record that already exists

Please Accept the solution if it assisted you with your question & Mark this response as Helpful.
Regards
Tanushree Maiti
ServiceNow Technical Architect
LinkedIn: https://www.linkedin.com/in/tanushreemaiti

Nishant8 · 3 weeks ago

Hello @rconstantino, good to know that with Write ACL problem is resolved.

ACLs support CRUD transactions where Create, Read, and Delete use their standard names during ACL creation. However, the Update transaction is named 'Write'.

I hope it clears the doubt.

please refer below for more details:

C:\Users\vishnoi\Documents\ServiceNow_Event_Management_Integration_Issues.doc

Regards,

Nishant

Lakshmi888888 · 3 weeks ago

The servicenow documentation: https://www.servicenow.com/docs/r/platform-security/access-control/acl-rule-types.html gives very detailed information about ACLs. Hope it will help you to understand more about ACLs

Please mark this response as Helpful or Correct if it helped.

glideFather · 3 weeks ago

Ahoy @rconstantino,

it looks as the ACL are given for create operation but not for write (update) operation.

My PDI is super slow (if I manage to access it, then I add a screenshot), you can navigate to access analyser:

https://yourDomain.service-now.com/now/access-management/access-analyzer/params/selected-tab-index/0

Select that user, that table and record, it will give you insights why they cannot update the record - what ACL in particular as well as whether it is the condition, the role or scripted part of it...

This is one of the most undervalued features of the whole Platform!

✂-----Cutting-out-the---✦AI-noise✦---All-replies-written-and-vouched-for-by-GlideFather---