Hi @AakankshaSK,
You actually ruled out the right things, which narrows this down.
There is a separate mechanism worth knowing about first - UI Builder components have their own "Edit component visibility" option, the eye icon in the component config panel, where you can attach a scripted hide condition using api.context.session.user.roles, something like checking roles.indexOf('admin') and returning true or false. That's the standard way to gate a component by role at the UI Builder layer. Since you found nothing set there, that confirms the block is not happening at that layer either, so it's not a simple missing visibility script you can just add.
That leaves the data layer. The Record History tab on the Standard Record Page pulls its rows through its own data resource, not a plain related list bound to sys_history_set, which is exactly why an ACL on that table had no effect, the component isn't asking the ACL engine that question at all. The role check (admin, sn_hr_core.admin, sn_hr_core.manager) is happening inside whatever script or scripted REST resource backs that data resource, before your ACL layer ever gets consulted.
There's also a known platform issue that matches your symptoms closely, non-admin users get an empty Record History list in Workspace, and the sys_id passed into the filter comes back empty for them specifically. That points to the context (the record's sys_id) not being propagated correctly into the data resource for non-privileged sessions, which is a defect-shaped problem, not just a config gap.
Given that, two real paths forward. Either open the Record History component's data resource definition in UI Builder and check exactly what role check or script include it's calling, then extend that logic to include sn_hr_core.basic if it's editable. Or, since this lines up with a known issue, log it with ServiceNow support referencing the empty sys_id in filter symptom specifically, it's possible this needs a platform fix rather than a workaround on your end.
