Clarification on Primary Contact access expectations in Incident Management

[sheilabarro]

Hi Community,

I'm looking for clarification regarding the expected behavior of Primary Contact user in Incident Management.

Does being listed as a Primary Contact grant access to an Incident record? I'm trying to understand the standard ServiceNow behavior regarding Incident Contacts.

My understanding is that a user may receive notifications as a Primary Contact without necessarily having permission to access the Incident record itself.

Is this the expected behavior? Is there any official documentation covering this scenario?

Thank you in advance for any insights.

[Vikram Reddy]

Hello @sheilabarro,

Keep two systems separate in your head: who gets notified and who can open the record are handled by completely independent mechanisms in ServiceNow, and being in one does not imply the other.

Notification recipients get built by the notification engine off the "Who will receive" tab, which supports Users, Groups, or "Users/Groups in fields," the option that lets a notification pull a recipient straight off any field on the triggering record, including a Primary Contact field. That resolution happens with no read-access check against the record at all.

Record access, on the other hand, is decided purely by Access Control (ACL) rules on the incident table: role, condition, and script all have to evaluate true before someone can open it. There is no out of the box ACL that grants access just because a user's sys_id shows up in a contact-type field.

You can see the identical pattern with watch_list: adding someone there drives notifications but does not open the record, you have to write a scripted ACL for that separately. To confirm this in your instance, check:

• the incident (read) ACL, whether its condition or script references Primary Contact at all
• the relevant notification record, whether Primary Contact is being pulled in via "Users/Groups in fields"
• if contacts do need to view the incident, add a dedicated ACL (or portal view) that explicitly checks that field against gs.getUserID()

So yes, your read is correct: unless someone has explicitly written an ACL for it, Primary Contact is a notification-only concept, not an access grant.

Thank you,
Vikram Karety
Octigo Solutions INC