Read Only ACL on Service Case table allows RO but prevents all existing users from accessing Cases

[Trish Mac]

Hello,

Goal is to create a View Only access to the Service Case table.  Created a group that has the sn_customerservice.case_viewer and the sn_customerservice.case_task_viewer applied to it. 

Created an ACL of

type=record

Operation=read

Decision Type=Allow If

Protection Policy=None

Name=Service Case table name

Application=Service Case

Role=sn_customerservice.case_viewer

This works to allow people in the above group to view cases.  However it intermittently prevents CSM users from viewing Cases.  Mostly prevents, occasionally allows.  When I apply this in DEV and TEST and impersonate people, I get mixed results - one day the CSM users can see cases and other times they can't.  Disabling the ACL or putting people in the group allows them to see the Cases if they've been prevented but this is not acceptable.

I don't know how to fix this and still create a View Only access for Cases.  Screen shot of ACL attached.

Thanks,

Trish

[Brian Lancaster]

Instead of using the role in the ACL. I would use an advanced script in the ACL to check if the user is a member of the group you created.

[Trish Mac]

Hi Brian, I gave you a Helpful on this.  I was reviewing this whole situation and realized that the only reason I created an ACL in the first place was because I thought the reason persons with View Only couldn't see Cases on the Application menu were because the app uses a custom table.  In fact, the answer was in a response you gave me in a previous question - to give the role access to the necessary modules.  I was still using the ACL and then realized...the ACL isn't necessary.  I've deleted it and the View Only access works by adding people to the group with the required roles and giving that role access to the modules.  No more conflicts.  Your previous answer resolved my overall issue.  I'm a little embarrassed but I've learned a lot through the process. Thank you again.

Trish