Why is record confidentiality inheritance restricted to only pre-existing related records?

[HaydenW]

Hi all,

My team and I have implemented record confidentiality inheritance according to ServiceNow's recommended guidelines and found that when confidentiality is enabled for a parent record ONLY pre-existing related records are marked confidential through inheritance. The same behavior does NOT occur for any new related records associated with the confidential parent record.

As a result of our internal investigation, our team found that servicenow intentionally didn't include this functionality. Here is a link to the documentation we are referencing: https://www.servicenow.com/docs/r/governance-risk-compliance/grc-common-functions/confidential-inher...

TLDR; Why did ServiceNow choose to allow new related records to not inherent record confidentiality even if the records' parent record is marked confidential?

[GouthamAnumolu]

hi @HaydenW  , confidentiality inheritance can be used on only those tables which are already confidentiality enabled. For example - GRC issue is linked to Entities(M2M) as well as remediation tasks. Confidentiality inheritance works OOB only on remediation tasks because it is already enabled with confidentiality. For you to make it work on Entities, you need to enable confidentiality on entity table by using this KB - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1497382

I hope this answers your query. Let me know if you need more details. (https://www.servicenow.com/docs/r/governance-risk-compliance/grc-common-functions/configure-confiden...)

[HaydenW]

Hi Goutham, thank you for your reply.

I understand where you are coming from, but I think I might've confused you with the way I worded the question. I am referring to the OOTB limitation that prevents newly created downstream records to not inherit a parent record's confidentiality even when both the parent and downstream related record have confidentiality inheritance configured.

As of right now, if record confidentiality inheritance is configured and a parent record is marked confidential, then the pre-existing downstream records will also be marked confidential. But if you create a new downstream record related to the parent record, then confidentiality is not automatically populated for that record. Is there a reason as to why the configuration follows this behavior?

[GouthamAnumolu · Accepted solution]

Got it, can you check the last section in this KB - https://support.servicenow.com/kb?sys_kb_id=80f48b1c1b7b1510c17111751a4bcbef&id=kb_article_view

You can use related list action mentioned in above KB or create a custom BR to solve the use case. 

The reason is that we did not receive this request during development, so we made it an optional configuration. You can submit it as an enhancement request in the idea portal.