Assignment group members can edit respective incident. for other users incident should be read only

[abc1233]

Only Assignment group members can edit respective incident. for other users incident should be read only except worknotes , worknotes should be editable to all itil users, please give me "Deny Unless" ACL because if im trying to create normal ACl , because of OOB ACL's my ACL is not working.

[Tanushree Maiti]

Hi @abc1233 

Could you use Access Analyzer to identify which ACL is causing the access issue? It should help pinpoint the specific table- or field-level ACL that is denying access and provide insight into the ACL evaluation path.

[PoonkodiS]

Hi @abc1233 

you have to create two acl

1. type:record

 operation :write

table :incident.none

role :itil

decision type : deny unless

condition : assignment group| is (dynamic) |one of my groups 

2.

type:record

 operation :write

table :incident.work_notes

role :itil

decision type : Allow if

Restrict for ITIL Users - should not see the other groups tickets - Support and Troubleshooting - No...

Servicenow evaluates deny unless before allow if acl

[abc1233]

Hi @PoonkodiS 

I tried this but still worknotes are not editable

[PoonkodiS]

Hi @abc1233 

1.create a row level acl

type:record

operation :write

table :incident.none

role :itil

2.

type:record

operation :write

table :incident.*

decision type : deny unless

script :

// If user is in the group, allow editing. If not, block it.
if (current.assignment_group.nil() || gs.getUser().isMemberOf(current.assignment_group)) {
answer = true;
} else {
answer = false;
}

3.

type:record

operation :write

table :incident.work_notes

role :itil

decision type : Allow if

[abc1233]

@PoonkodiS i tried this as well but no luck😑