We have an OOB before query Business Rule (Order: 100) on the sys_user table that restricts access to inactive users. Currently, only admin and specific privileged users can view inactive user records. As a result, tickets (such as RITMs/Incidents) raised by inactive users display "Security constraints prevent access" for other users because the requester record is inaccessible.
Our requirement is to allow IT fulfillers to view tickets raised by inactive users while maintaining appropriate security.
Would you recommend:
- Modifying the existing OOB Business Rule to include the required IT roles, or
- Creating a custom Business Rule that overrides or supplements the OOB logic?
What would be the recommended approach to achieve this while following ServiceNow best practices?
Business rule code:
Condition: gs.getSession().isInteractive() && !(gs.hasRole("admin") || gs.hasRole("user_admin") )
Code:
current.addActiveQuery();
