Application Cross Scope privilege not working.

SatyendraS18225
Tera Contributor

28m ago

I wrote a after insert BR on incident table in which i want to delete a record of Table.
 
(function executeRule(current, previous /*null when async*/) {
    var gr = new GlideRecord("x_1981567_peak_de_iceing");
    gr.addQuery('number',"DE-0001019");
    gr.query();
    if(gr.next()){
        gr.deleteRecord();
    }
  
})(current, previous);
 
(x_1981567_peak_de_iceing ) of application scope where can delete is already unchecked(Ref to screenshot).

SatyendraS18225_1-1792581160387.png


& There is no sys_restricted_caller_access record & no sys_scope_privilege record made against this custom scope table.

As per my perspective custom table record should not delete but actually record is deleted, Why????


 
0 Helpfuls
  • 36 Views
2 REPLIES 2

Ranjit Nimbalka
Mega Sage

20m ago

Hi @SatyendraS18225 ,
can you please check the scope of your Business rule record.

 

 

0 Helpfuls

Tejas Adhalrao
Mega Sage

46 seconds ago

hi @SatyendraS18225 ,

The important thing to understand here is that the Can delete setting under Application Access is related to cross-scope access. It does not necessarily block a server-side GlideRecord.deleteRecord() call when the code is executing within the same application scope as the target table.

In your example, I would check the following:

  1. Application scope: Confirm the scope in which the Business Rule executes and compare it with the scope of x_1981567_peak_de_iceing.

  2. Cross-scope access: If the Business Rule runs from a different scope, check the cross-scope privileges and restricted caller access configuration.

  3. Delete ACLs: Check whether any applicable delete ACLs restrict deletion. Standard GlideRecord does not enforce record ACLs in the same way as GlideRecordSecure.

  4. Test with GlideRecordSecure: You can use this to verify whether ACL enforcement changes the result, although it is not a substitute for checking cross-scope access.

Also, make sure you distinguish between Application Access restrictions and ACL enforcement. They are separate security mechanisms.

If the Business Rule and the custom table are both in the Peak scope, the deletion may be allowed because the operation is occurring within the same scope, even though the Can delete checkbox is unchecked.

 

If this helps, please mark it helpful or accept it as the solution.

Regards,

Tejas

0 Helpfuls