Hi @abc1233 

To achieve this requirement, you can create a Deny Unless Write ACL on the Incident table and another on the work_notes field. Because Deny Unless ACLs are evaluated with higher precedence than standard ACLs, they can be used to enforce your custom access criteria and effectively override the default OOB write access behavior.

1. Table level deny acl

• Type: record
• Operation: write
• Name: Incident [incident]
• Decision Type: Deny unless
• Condition: Assignment group is dynamic One of my groups // update condition as per your requirements.

if (current.assignment_group.nil()) {

    answer = true;

} else {

    answer = gs.getUser().isMemberOf(current.assignment_group);

}

1. Field level Deny Acl

Type: record

Operation: write

Name: Incident [incident] -> Select work_notes from the field dropdown.

Decision Type: Deny unless

Roles:  itil