How to restrict read access to few fields on HR case table for a service account?

[sagarika11]

Hi,

We have a requirement to create a scripted rest API to read HR case data and return case number, created, updated , state and HR Service field values in the response.

This has been successfully implemented.

However we have additional requirement that the Service account which is used to call the scripted rest api should read the above fields , Service Account should not have read access to other fields.

Tried to create a custom role, adding a new coe security policy, new ACLs. But it does not give service account enough permission to read the fields.

Can you help with the best way to achieve this restriction?

[Rafael Batistot]

Hi @sagarika11 

Use a dedicated role + ACLs.

• Create a role specifically for the integration account.
• Give the account only this role.
• Create table-level read ACL for the HR Case table.
• Create field-level read ACLs only for number, sys_created_on, sys_updated_on, state, and hr_service.
• Ensure the account has no inherited roles providing broader HR Case access.
• Keep the Scripted REST API restricted to this role.

If HRSD COE Security Policies are blocking access, they also need to be aligned. The important point is that field ACLs alone don’t grant table access.

https://ikconsulting.com/post/best-practices-for-making-fields-read-only-in-servicenow

[Ankur Bawiskar]

@sagarika11 

my thoughts

-> Enable ACL enforcement on the Scripted REST API resource:

-> Create a custom role (e.g., hr_case_limited_reader) and assign it only to the service account.

-> Configure a COE Security Policy for sn_hr_core_case:

• Grant Read access only to: number, sys_created_on, sys_updated_on, state, hr_service.

• Associate the custom role with this policy

-> Add field-level ACLs as a safety net and add your custom role their

-> Avoid broad table-level read ACLs for this role—field ACLs only work if table access is granted, but shouldn’t expose extra fields.

Also check this KB, KB3144199 

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[SagarikaSwain]

Hi Ankur,

I tried this , but it does not help.

I have added the coe security policy as below:

The group has the custom role added and service account is part of this group.

Below ACLs are added.

While logging in as the Service account, I am expecting this configuration should display 'number' field in HR case table, however I see an empty table.