ACL restriction for one assignment group to only members

[Daniela18]

I have a requirement to restrict incidents assigned to group "Network" to only network group members.

I tried this ACL. Can someone tell me what I am doing wrong because when I impersonate someone not in network I can read/ update/ write on the incident etc.

[MrMuhammad]

Hi Daniela,

For restricting records of specific group to their members, It is recommended to use Before Query Business rule instead of ACLs. You can see my response to the similar question on the below thread.

https://community.servicenow.com/community?id=community_question&sys_id=1349fc14dbad141023f4a345ca96...

For your ease, I am posting the same code here. it is tested and validated.

  var currentUser = gs.getUser();
  var isMember = currentUser.isMemberOf('SYS_ID_OF_GROUP');

  if (isMember == false) {
      if (gs.getSession().isInteractive()) {
         var query = current.addQuery('assignment_group', "!=", 'SYS_ID_OF_GROUP');
      }


  }

Please mark this accepted & helpful if it answered your question.

Thanks & Regards,
Sharjeel

[Daniela18]

I tested this but it did not work.

Are you sure it is verified. It was not marked as the solution in the link you added.

[MrMuhammad]

Can you confirm if the BR is Before Query and what addInfoMessages return?  It is working flawlessly for me.

[MrMuhammad]

I think you have missed wrapping the code inside function. 

please copy paste below.

(function executeRule(current, previous /*null when async*/ ) {
    //   a18eab07931331003b4bb095e57ffbdf
    var currentUser = gs.getUser();
    var isMember = currentUser.isMemberOf('a18eab07931331003b4bb095e57ffbdf');
    gs.addInfoMessage(isMember + "======" + currentUser);
   
    if (isMember == false) {
        gs.addInfoMessage(isMember + "======" + currentUser);

        if (gs.getSession().isInteractive()) {
            var query = current.addQuery('assignment_group', "!=", 'a18eab07931331003b4bb095e57ffbdf');
        }
    }


})(current, previous);

. 

[Daniela18]

Where will I see this info message?