Edit Access on Field

[KRISHNACHAR0083]

Hi All,

This is regarding the ACL and UI policy.

In the kb_feedback_task table, we have created read and write ACLs. So, now the user can able to access the record and that two ACL are passed. But here the problem is still the user not able to edit the fields even if read and write ACL passes. So i verified there are field level ACLs on all the fields. But we can't create those many field level ACLs or modify.

So, can we able to give edit access to the fields by using UI policy?

Or is there any other possibility?

[Ankur Bawiskar]

@KRISHNACHAR0083 

correct, both ACL and UI policy are different things and work differently

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[Tanushree Maiti]

Hi @KRISHNACHAR0083 

Using Access Analyzer  check which Write ACL restricting edit access for user. Also if already OOB that field level write ACL exists, check that ACL role whether user having .

[KRISHNACHAR0083]

Ok fine but can't we able to override the field level write ACL with UI policy?

[Tanushree Maiti]

Hi @KRISHNACHAR0083 

When a field is made read-only using a UI Policy (client-side), its behavior and security implications differ significantly from those of an ACL (server-side) :

An UI Policy only controls the field’s visual presentation on the standard form in the browser, such as displaying it as read-only or greyed out. It does not enforce actual data security or prevent unauthorized modifications.

Since UI Policies operate on the client side, their restrictions can be bypassed through alternative methods, such as list editing, REST/SOAP integrations, import sets, or background scripts.

Therefore, UI Policies should be used for controlling the user interface, while ACLs should be used to enforce server-side access control and protect data integrity.

If an ACL restricts write access to a field, a UI Policy cannot override that restriction to make the field editable. Regardless of how the field appears on the form, the server-side ACL will enforce the access restriction and reject any unauthorized write attempt.

For your use case , I will recommend you to go with ACL.

[Utpal Dutta]

Hello Krishna,

In short, you can't override field level ACL with UI policy. If you want to understand which ACL is blocking the write access then you can use ServiceNow's Access Analyzer module. I've added the documentation link below.

How to use Access Analyzer: https://www.servicenow.com/docs/r/zurich/platform-security/access-control/using-evaluate-access.html

Let me know if I can help you in any other way. Also, If my answer helps then please accept my answer & mark it helpful

Best,

Utpal