Reference Field to sys_user_role Not Visible to Custom Scoped App Users While Equivalent Glide List

[mkm1]

Hello Community,

I'm looking for guidance on an issue encountered after replacing a Glide List field with a Reference field.

I had a field:end_user_roles configured as: Type: Glide List Reference: sys_user_role

Users were able to see and use this field without any issues.

 

Since only a single role is required, I replaced it with: end_user_role configured as: Type: Reference

Reference: sys_user_role

Issue: After changing the field type:

• Administrators can see and use the field normally.
• Non-admin users cannot see the field on the form.
• The field is present on the form layout/view.
• There are no UI Policies hiding the field.
• No Client Scripts are hiding the field.
• The Dictionary record does not appear to have any obvious restrictions configured.
• Even creating field level ACL didn't solve the issue

[Hemanth M]

Hi @mkm1 ,

Have you verified this in access analyzer, if not verify once (read, write, create access on this filed)

Hope it helps!

[mkm1]

Yes, I verified the access configuration and created ACLs that grant read and write access to the field. However, direct access to the sys_user_has_role table from a custom scoped application was not found to be consistently available. As a result, we implemented a scoped table to maintain application-specific role assignments and mapped the required sys_user_role records into that table.

With the Brazil release, ServiceNow appears to be further strengthening cross-scope security enforcement. Additionally, platform security restrictions may limit direct access to certain system tables, including sys_user_has_role, from custom scoped applications. Consequently, we chose not to depend on direct queries against sys_user_has_role. Instead, decided the application maintains the required role and assignment relationships within scoped tables to ensure consistent behavior, security compliance, and Store application compatibility across ServiceNow releases.

With the Brazil release, ServiceNow appears to be further strengthening cross-scope security enforcement. Additionally, platform security restrictions may limit direct access to certain system tables, , from custom scoped applications. Consequently, we chose not to depend on direct queries against sys_user_has_role. Instead, the application maintains the required role and assignment relationships within scoped tables to ensure consistent behavior, security compliance, and Store application compatibility across ServiceNow releases.