User with 'skill_admin' role can add and remove group members from the group

[AshishSamuD]

As shown in the image, I am unable to add and remove group members from both the group whose name starts with "RM" and whose name does not start with "RM". I want that a user with 'skill_admin' role should be able to add and remove group members from the group whose name starts with "RM". While the same user should not be able to add and remove group members from group whose name does not starts with "RM". How to proceed with the task?

[Adrian Ubeda]

Hello @AshishSamuD , 
You can control this with the list control, click on the gear and select list control, should appear something similar as this:

Or, you can find it in the proper table sys_ui_list_control where table is sys_user_group and related list is sys_user_grmember.group 

[AshishSamuD]

Hello @Adrian Ubeda 

I am unable to get the list control feature for a user having 'skill_admin' role. Please help.

[IbrarA]

Hi @AshishSamuD ,

Since your rule depends on the group name, this needs ACLs on sys_user_grmember.

Write and delete are straightforward. Give each the skill_admin role and use this in the script:

answer = current.group.name.startsWith('RM');
The usual approach is to open create up to the role, then back it with a before business rule on insert that checks the group name and aborts if it isn't RM.

If it still lets them through, look for existing ACLs on that table, especially any with Admin overrides ticked, as those can sit in another scope and quietly win.

Same setup discussed here: https://www.servicenow.com/community/servicenow-ai-platform-forum/acl-to-restrict-users-to-add-remov...

thanks