How to create an ACL rule to restrict a role from seeing a specific service offering

Hello,

How can I modify the Read acl rule to restrict visibility of "IT Customer Service" service offering from users with a specific role "cbt_restriction".  It is restricting access for the role but also snc_internal role (our end users)   .  How can I modify this ACL script to make this happen?

var answer=true; //Restrict access by default

if( gs.getUser().hasRole('cbt_restriction'));
{
answer=false;
}