Metrics (metric_instance) showing changes for fields despite field level ACL restrictions

[ServiceNowVS]

Hi,

We have Metric Definition for a table on specific fields. Now the metrics getting generated are showing field value changes to user, even though that field is restricted for that user via ACL.

Eg:

1) Metric Definition is defined on "Incident" table for field "Assigned to".

2) Field level ACL is created on "Assigned to" field for some users. Those users cannot see value in Assigned to field in incident table.

3) There is parent-child incident relationship with syncing enabled. Now when the Assigned to of parent is changed, child incidents are also updated. Metrics (metric_instance) are created to show previous and current value.

4) If a user checks the metric table, even though they dont have access to assigned to in incident table, they can still the changes in metric_instance table.

Any idea how can we restrict the access here as well?

[Shubham Singh]

Hi @ServiceNowVS 

As your ACL is created on Incident table it will restrict its visibility on incident table only not all tables.

Create an ACL on the metric_instance table to control the visibility.

Thanks!

Please mark this response as correct and helpful if it works ✔️👍

[Dr Atul G- LNG]

Hi @ServiceNowVS 

ACL work on table where it has been applied. As per your description, you need to create ACL on metric table not Incident.