Hi @Priya Singh 2 2 ,

Attachments are stored in the sys_attachment table, which is separate from your custom test_xyz ticket table. So ACLs applied to your ticket table don't automatically apply to attachments. By default, OOB read ACLs on sys_attachment allow access broadly, meaning even users without access to the ticket record may still see attachments. Simply controlling access on the parent table isn't enough, you must explicitly control access at the attachment level.

1. A common workaround is to create a custom Boolean field (something like u_private) on sys_attachment and use it to flag attachments that should be hidden from non authorized users.

2. You can enforce more granular control using a Deny Unless ACL that restricts attachment visibility based on ownership or group membership.

If you found my response helpful, please mark it as ‘Accept as Solution’ and ‘Helpful’. This helps other community members find the right answer more easily and supports the community.