policy exception creation flow

GannahA
Tera Contributor

Hi community, 

I've created a flow that triggers by Service Catalog, awaits the condition that the state of a RITM is completed, to then create a policy exception record in the Policy exception table.

The flow works fine when testing in Flow Designer, however when it's time to go through the process outside of flow designer and a RITM becomes closed complete, no Policy Exception is created.

I've created the flow in both the Global scope and the GRC Policy and Compliance scope to test if it'll work, but nothing changed.

 

Any idea how to go on about this?

3 REPLIES 3

vaishali231
Mega Guru


Hi @GannahA 

This behavior is actually expected and usually comes down to how Flow Designer runs during testing vs real execution.

When you test a flow in Flow Designer, it runs with elevated permissions, so ACLs and cross-scope restrictions are bypassed. When the same flow runs in real time (when the RITM is actually closed Complete), it runs under normal system context and all ACLs apply. Because the Policy Exception table is part of GRC, write access is heavily restricted, which is why the record is not being created.

There are also two other common causes to check:

1. Trigger vs Wait condition
If your flow is:
Trigger → Wait for condition → Create Policy Exception

The wait condition may never resume. In many cases, the RITM state changes to Completed before the flow reaches the wait step.

Recommended approach:
Use the trigger condition State changes to Completed on sc_req_item and remove the Wait condition entirely. This avoids timing issues.

2. ACL / Cross-scope access
Even if the trigger fires correctly, the flow can silently fail when trying to insert into the Policy Exception table.

To confirm:
Check System Logs > All and filter for:

Source = Flow Engine

Level = Error

You will usually see an access or cross-scope error.

 

 
Create a Script Include in the GRC scope that inserts the Policy Exception record, and call that Script Include from the flow. This is the safest and supported approach for GRC tables.


*************************************************************************************************************
If this response helps, please mark it as Accept as Solution and Helpful.
Doing so helps others in the community and encourages me to keep contributing.

Regards
Vaishali Singh

yashkamde
Tera Expert

Can you share the flow ss ??

VaishnaviK43271
Tera Contributor

Hi @GannahA !!

Since the flow is triggered from Service Catalog, it starts before the RITM is closed. The Wait for Condition step then correctly waits for the RITM to move to Closed Complete and creates the Policy Exception. It works outside Flow Designer as long as the state change happens after the flow starts.

 

Screenshot 2026-01-15 112957.png

 

Mark this as Helpful if it clarifies the issue.
Accept the solution if this answers your question.

Regards,
Vaishnavi
Associate Technical Consultant