Assignment group members can edit respective incident. for other users incident should be read only

[abc1233]

Only Assignment group members can edit respective incident. for other users incident should be read only except worknotes , worknotes should be editable to all itil users, please give me "Deny Unless" ACL because if im trying to create normal ACl , because of OOB ACL's my ACL is not working.

[Tanushree Maiti]

Hi @abc1233 

To achieve this requirement, you can create a Deny Unless Write ACL on the Incident table and another on the work_notes field. Because Deny Unless ACLs are evaluated with higher precedence than standard ACLs, they can be used to enforce your custom access criteria and effectively override the default OOB write access behavior.

1. Table level deny acl

• Type: record
• Operation: write
• Name: Incident [incident]
• Decision Type: Deny unless
• Condition: Assignment group is dynamic One of my groups // update condition as per your requirements.

if (current.assignment_group.nil()) {

    answer = true;

} else {

    answer = gs.getUser().isMemberOf(current.assignment_group);

}

1. Field level Deny Acl

Type: record

Operation: write

Name: Incident [incident] -> Select work_notes from the field dropdown.

Decision Type: Deny unless

Roles:  itil

[abc1233]

Hi @Tanushree Maiti 

i tried this but still worknotes are not editable

[Mark Manders]

Did you clear your cache or log out/in again after creating the ACLs?

[abc1233]

@Mark Manders yes i did