ACL restriction for one assignment group to only members

[Daniela18]

I have a requirement to restrict incidents assigned to group "Network" to only network group members.

I tried this ACL. Can someone tell me what I am doing wrong because when I impersonate someone not in network I can read/ update/ write on the incident etc.

[Ankur Bawiskar]

Hi,

possibly some other table level READ ACL is allowing the access

what is your exact requirement?

Members of Network group should see only Incidents assigned to Network group

Regards
Ankur

[Daniela18]

Basically If assigned to group Network and Service is email, Category is Software and sub-category is email, it should only be readable to members in the assignment group of the group "Network"

[Ankur Bawiskar]

Hi,

please update query business rule as below which is on incident table

BR: incident query

This is out of the box BR

Highlighted in bold is updated code

Note: ensure you use valid encoded query

Form the query from the table list and copy there

restrictIncidents();

function restrictIncidents() {
    if (!gs.hasRole("itil") && !gs.hasRole("sn_incident_read") && gs.isInteractive()) {
        //Do NOT restrict Incidents if SPM premium plugin is active AND user has the service_viewer role.
        if (GlidePluginManager.isActive('com.snc.spm') && gs.hasRole('service_viewer'))
            return;
        
        var isMember = gs.getUser().isMemberOf('Network');
        if(isMember == true){
            current.addEncodedQuery('category=software^subcategory=email^service=email');
        }
        else{
        var u = gs.getUserID();
        current.addQuery("caller_id", u).addOrCondition("opened_by", u).addOrCondition("watch_list", "CONTAINS", u);
        }
    }
}

Mark ✅ Correct if this solves your issue and also mark 👍 Helpful if you find my response worthy based on the impact.
Thanks
Ankur

[Daniela18]

I tried that but it did not work