How to restrict read access to few fields on HR case table for a service account?

sagarika11 · 6 hours ago

Hi,

We have a requirement to create a scripted rest API to read HR case data and return case number, created, updated , state and HR Service field values in the response.

This has been successfully implemented.

However we have additional requirement that the Service account which is used to call the scripted rest api should read the above fields , Service Account should not have read access to other fields.

Tried to create a custom role, adding a new coe security policy, new ACLs. But it does not give service account enough permission to read the fields.

Can you help with the best way to achieve this restriction?

Rafael Batistot · 5 hours ago

Hi @sagarika11

Use a dedicated role + ACLs.

Create a role specifically for the integration account.
Give the account only this role.
Create table-level read ACL for the HR Case table.
Create field-level read ACLs only for number, sys_created_on, sys_updated_on, state, and hr_service.
Ensure the account has no inherited roles providing broader HR Case access.
Keep the Scripted REST API restricted to this role.

If HRSD COE Security Policies are blocking access, they also need to be aligned. The important point is that field ACLs alone don’t grant table access.

https://ikconsulting.com/post/best-practices-for-making-fields-read-only-in-servicenow

If this response was helpful, please mark it as Helpful and, if applicable, as Correct.
This helps other users find accurate and useful information more easily