Legal Hold Button

[alekhyaazme]

There is research that when HR agent apply legal hold on the HR profile, HR agent need sn_hr_core.profile_writer to add legal hold, but if the HR Agent has this role it gives the edit access to the sensitive fields on the hr profile, so without giving this profile writer role, and if the hr agent has sn_hr_ef.legal_hold_writer they need to apply a legal hold on hr profile. How find solution for this I need assistance on this

[Mariam_Ahmed]

Hi @alekhyaazme,

There are two ways we can handle this:

Option 1: Use field-level ACLs
1- Record-Level: Modify the write ACL for sn_hr_core_profile (the one with no field selected) to include the sn_hr_ef.legal_hold_writer role. This allows them to technically "edit" the record.
2- Field-Level (Sensitive): Ensure your field-level ACLs (like sn_hr_core_profile.*) still strictly require sn_hr_core.profile_writer. This keeps the sensitive fields read-only for your HR agents.
3- Field-Level (The Hold): Create a new write ACL specifically for sn_hr_core_profile.legal_hold and add the sn_hr_ef.legal_hold_writer role, which makes only that specific field editable.

This approach would allow the agents to update only the Legal Hold field without giving them access to edit the other profile fields.

Option 2: Use a Server-Side UI Action

Another, more secure approach would be to keep the profile completely read-only for these agents and provide an "Apply Legal Hold" button.

1. Create a UI Action called "Apply Legal Hold."

2. Condition: gs.hasRole('sn_hr_ef.legal_hold_writer') && current.legal_hold == false

3. Script: Use a server-side script to set current.legal_hold = true; current.update();.
   

Best Regards,

[Alekhya Azmeera]

@Mariam_Ahmed , 
Thank you
I will Try this

[Alekhya Azmeera]

There is one more query, If I implement those ACLs, when the upgrade version happens, does it will not impact, if the ServiceNow propose new additional requirements for the legal hold or else If due to these ACLs instance behavior may change

[Mariam_Ahmed]

Hi @Alekhya Azmeera,

Custom ACLs generally won’t be overwritten during upgrades, but they can affect new OOB functionality, roles, or security requirements introduced by ServiceNow. I’d document the reason  and include Legal Hold and security in regression testing after upgrades. So, while not completely upgrade-proof, the risk can be minimized with limited customization and proper testing.

Best Regards,