Thank you all for your answer. However this doesn't match with my testing, that's why I posted this question. I see on change_request.work_note field, we only have one create ACL which is granted to admin. However an general itil user can create work note as well. Something must be wrong then.