User doesn't have permission to SCTASK Variables

[dustinjones]

Hello,

Have a Flow that takes the RITM that is created from the Service Catalog and it creates multiple SCTASKS passing all the variables from the RITM to SCTASK. The Assignment groups on the SCTASKS don't have permission to see the RITM. For some reason this prevents them from being able to see the Variables on the SCTASK. As soon as I add someone to the group that the RITM is assigned to then the variables show up for that user on the SCTASK. I am preventing fulfillers from seeing tickets unless they they are the requestor, on the watchlist, assigned to or a member of the assignment group using a Business Rule. 

I am unsure how to give the user permission to see the variables on just their SCTASK. I assumed the flow was copying the variables to the SCTASK but it seems to be a reference from my testing.

Any help is appreciated.

Thanks

[AshishKM]

Hi @dustinjones ,

Share the BR configuration, conditions and code, not sure why you use the BR for restriction instead of using ACL. 

-Thanks,

AshishKMishra

[dustinjones]

Below is the on query BR. No conditions. I will be honest I am using this because I don't have admin experience with ServiceNow and this was how I figured out how to do it. I am very new to it and open to suggestions on better ways. Happy to look at other ways. Would ACL's be able to lockdown visibility to the RITM/SCTASK's but still allow variables to work in my scenario.

(function executeRule(current, previous /*null when async*/) {
	var qu = '';
   
	if(gs.getUser().hasRole("admin")) { //the user is not an admin
		qu = current.addEncodedQuery("");
	} 
	else if (gs.getUser().hasRole("itil") && gs.getUser().hasRole("bisopsadmin")) {
		qu = current.addEncodedQuery("sc_catalog=f38835c087f9e11042d386e80cbb3571^ORassignment_groupDYNAMICd6435e965f510100a9ad2572f2b47744^ORassigned_toDYNAMIC90d1921e5f510100a9ad2572f2b477fe^ORwatch_listDYNAMIC90d1921e5f510100a9ad2572f2b477fe^ORopened_byDYNAMIC90d1921e5f510100a9ad2572f2b477fe");
		
	}
	else if (gs.getUser().hasRole("itil")) {
            qu = current.addEncodedQuery("assignment_groupDYNAMICd6435e965f510100a9ad2572f2b47744^ORassigned_toDYNAMIC90d1921e5f510100a9ad2572f2b477fe^ORwatch_listDYNAMIC90d1921e5f510100a9ad2572f2b477fe^ORopened_byDYNAMIC90d1921e5f510100a9ad2572f2b477fe");
    
    
    }
    return;
 
})(current, previous);