Restrict HR incidents to only members of the HR group

[Community Alums]

I have a requirement to restrict any incidents that are assigned to the HR group to only be able to be seen by the members of that group. The users that are in the HR group have the ITIL role, as well as users of other groups. 

How should my business rule be configured to have only HR team members see the incidents that are assigned the HR group. See my Business Rule script below... How should the "When to Run" and "Actions" tab be configured? or does anything on those tabs need to be changed at all with the correct advanced script?

Condition: !gs.getUser().isMemberOf('<ServiceNow - HR>') || current.opened_by == gs.getUserID()

Script:

(function executeRule(current, previous /*null when async*/ ) {

        if (gs.isInteractive()) {

            testSec();

        }

        function testSec() {

            var testGroups = gs.getProperty('<ServiceNow - HR>');

            var myGroupsArr = getMyGroups().toArray();

            var restrictRecord = true;

               for (var i = 0; i < myGroupsArr.length; i++) {

                if (testGroups.indexOf(myGroupsArr[i]) >= 0) {

                    restrictRecord = false;

                }

            }

if (restrictRecord == true) {

                    var qc = current.addEncodedQuery("<assignment_group=405fdc544788aa5092e4054c416d4329>");        

                }

            }

        })(current, previous);

[Ankur Bawiskar]

@Community Alums 

you want to restrict incidents so you will have to update the existing OOB query business rule on incident to handle that particular group.

If my response helped please mark it correct and close the thread so that it benefits future readers.