Restrict write access to some fields for 'assigned_to' and 'assignment_group'

[AjvadK]

For Issues form, I want 'assigned_to', and 'assignment_group', users to be only able to modify certain fields. How to achieve this using ACL? 

[Ankur Bawiskar · Accepted solution]

@AjvadK 

then don't play with ACL

-> use display Business rule on that table and use g_scratchpad

-> then create onLoad client script and make fields readonly/editable

With this what happens -> ACL will allow but your client script will make readonly and you need not handle multiple ACLs

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[RaghavSh]

create "write" operation ACL on those fields with code:

answer=false;
if(gs.getUser().isMemberOf(current.assignment_group)) // this will alow only assigmnent group member to update the field. Also assigned to is member of assignment group so no extra code required.
answer=true;

This can be done via client side code also but that has limitations like list edit (need different code) and for non interactive sessions client script will not work. So best is to create ACLs

[AjvadK]

I apologise if my question wasn't worded correctly. The assignment group/assigned to should only be able edit certain fields. The rest of the fields should be read-only to them. 

[John Gilmore]

@AjvadK 

The previous answers cover how to write the ACL for a specific field is accurate but you need to have the correct hierarchy of ACLs to make this work correctly.

The first ACL will provide record level write permissions. So a table.none that contains a role such as ITIL that contains all of your possible assignees. It can be broader if necessary to achieve this.

The second ACL will be a field level ACL that denies write on all fields. This would be a table.* rule with no roles or users associated with it. After this rule you are allowing everyone in the first ACL to write or edit the record but have now denied their ability to edit each individual field on that record.

Once these two ACLs are in place you then add an advanced write ACL for each specific field that you want the assignee(s) to be able to edit.

if (gs.getUserID() == current.assigned_to || gs.getUser().isMemberOf(current.assignment_group))
    answer = true;
else
    answer = false;

To summarize what these rules do:

• The first rule grants edit permission to the record, without having edit permission at the record level there can be no edit permission at the field level.
• The second rule makes the default field level permission to edit blocked for all users.
• The field level rules override the default permission of the second rule for each specific field that you add it for.

Without all of these rules configured correctly you won't be able to set it up specifically the way you describe in the reply.

[AjvadK]

I am unable to create the second ACL,  because it is empty ACL. Popup says, "An empty or invalid Deny Unless ACL will completely deny access to this resource. To properly secure it, select a Role, Security Attribute or configure related records to allow access to it conditionally."