User with wm_read role is able to modify workorders - How to check who can write into wm_order tab

[Luby]

Hi,

I have a user group that contains wm_read role to see NOT modify workorders. The thing is that they can modify them. I should mention the instance is heavily customized. 

The group itself has 114 roles in total so it would be time consuming to check every role. (see below)

I´d like if you could advise what could be the fastest way to find the issue like what to check and where. I´ve never done this before. But my idea is to see what roles have "read" access into the wm_order table. But not sure how to do it. 

I´ll appreciate any advice 

Btw here is the list of Roles (base + inherited) 

     

[Zach Koch]

The easiest way would be to go look at the ACLs of the table where you do not want them to edit, filter the Operation column on write to show matching, then look through each ACL to find what roles are allowed to edit. Compare those roles to the roles your test user that is able to edit but shouldn't be able to, and see if they have any of them. Be sure when you are looking at the ACLs you only look at <your_table> prefixed ones, as tables that are extended from other tables will inherit their ACLs as well if there isn't a more specific one on your extended table.