Scoped Application Workspace: Unable to Prevent Attachment Deletion (No Conditional Delete ACL)

BenjaminLeong · 3 weeks ago

Summary
In a scoped application Workspace, users are able to delete attachments even when they do not have write access to the record. There also appears to be no way to implement conditional delete control for attachments within the scoped application.

Environment

Platform: ServiceNow
Application Type: Scoped Application
UI: Workspace
Component: Default Workspace Attachment component

Issue Description

Users are able to delete attachments from records in Workspace even though they do not have write access to the record according to ACL rules.

In this scoped application, write access to the record is restricted through ACLs. However, the default Workspace attachment component still allows attachment deletion.

Additionally, within a scoped application, there does not appear to be a way to implement a conditional delete ACL on the sys_attachment table to control attachment deletion based on record conditions or roles.

Steps to Reproduce

Create or use a table in a scoped application.
Configure ACLs so that a user does not have write access to the record.
Access the record in Workspace.
Upload an attachment (or use an existing attachment).
Select any uploaded attachment.
Attempt to delete the attachment (as shown in image above).

Result:
The user is able to delete the attachment despite lacking write access.

Expected Behavior

Attachment deletion should respect ACL restrictions.
Users who do not have write access to the record should not be able to delete attachments, or there should be a supported mechanism to control attachment deletion through ACLs or configuration.

Actual Behavior

Users can delete attachments from Workspace even when they do not have write access to the record, and there is no clear mechanism within the scoped application to enforce conditional delete restrictions.

Kieran Anson · 3 weeks ago

Hi,

I've not run through your steps to re-producible the issue. But some pointers. Is the table and workspace in the same scope? Is the scope configured for application administration? The benefit of configuring application administration is allowing for scoped ACLs to apply first, and you can selectively determine whether global ACLs apply. This would allow you to add a scripted condition into an ACL and disable deleting of an attachment similar to GRC/HR/Supplier management applications

https://www.servicenow.com/docs/r/application-development/ACL-access-checks.html?contentId=UBYQYBZcf...

BenjaminLeong · 3 weeks ago

Hi, thanks for the pointers.

Yes, the table and the Workspace are both part of the same scoped application.
Application Administration is enabled for the application, so scoped ACLs should be evaluated before global ACLs.

The difficulty I'm encountering is with controlling deletion on sys_attachment. Since sys_attachment is in the global scope, it doesn't appear possible to implement the conditional delete logic from within the scoped application to evaluate the parent record’s access conditions.

As a result, users who do not have write access to the record are still able to delete attachments through the Workspace attachment component.

Have you previously implemented attachment delete restrictions in Workspace using ACLs on sys_attachment, or was another mechanism used?

Thanks again for the suggestions.

Sincerely,
Benjamin

BenjaminLeong · 3 weeks ago

Hi, thanks for the pointers.

Yes, the table and the Workspace are both part of the same scoped application.
Application Administration is enabled for the application, so scoped ACLs should be evaluated before global ACLs.

The difficulty I'm encountering is with controlling deletion on sys_attachment. Since sys_attachment is in the global scope, it doesn't appear possible to implement the conditional delete logic from within the scoped application to evaluate the parent record’s access conditions.

As a result, users who do not have write access to the record are still able to delete attachments through the Workspace attachment component.

Have you previously implemented attachment delete restrictions in Workspace using ACLs on sys_attachment, or was another mechanism used?

Thanks again for the suggestions.

Kieran Anson · 3 weeks ago

I haven't personally implemented attachment delete restrictions, but it looks to be possible. For example, below shows a delete restriction imposed by the HR: Core scope