I have a BR which is high risk should i modify it?

[NeethuB]

We have an OOB before query Business Rule (Order: 100) on the sys_user table that restricts access to inactive users. Currently, only admin and specific privileged users can view inactive user records. As a result, tickets (such as RITMs/Incidents) raised by inactive users display "Security constraints prevent access" for other users because the requester record is inaccessible.

Our requirement is to allow IT fulfillers to view tickets raised by inactive users while maintaining appropriate security.

Would you recommend:

• Modifying the existing OOB Business Rule to include the required IT roles, or
• Creating a custom Business Rule that overrides or supplements the OOB logic?

What would be the recommended approach to achieve this while following ServiceNow best practices?


Business rule code:
Condition: gs.getSession().isInteractive() && !(gs.hasRole("admin") || gs.hasRole("user_admin") )
Code: 

current.addActiveQuery();

[Dr Atul G- LNG]

not to do it, but if it is needed, make the change or copy and modify it, then test it thoroughly.

[yashkamde]

Hello @NeethuB ,

I'd recommend modifying the existing ootb BR condition (not the script), rather than creating a duplicate BR. Since it's a before query BR, a second one would just conflict with the OOB one over the same addActiveQuery() logic, there's no clean way for two of them to coexist.

If my response helped mark as helpful and accept the solution.

[Ankur Bawiskar · Accepted solution]

@NeethuB 

1st question how inactive users are raising the Request?

share complete details

[NeethuB]

Employee is creating the tickets from ESC Portal (Catalog).