Fulfiller user cleanup

[JakeBaynes]

Hey SN people,

New job, trying to clean up fulfillers, it's a mess lol.

I wanted to post my workflow to see if what I'm doing makes sense to others and whether it is going to accurately identify where we can clean things up.

Our account reps have provided a report of all users who have roles that are considered fulfillers and how that all ties in to our subscriptions.

We have a custom built app that extends the incident table which has two roles, one of which has been given to way too many people and it is flagged as a fulfiller role.

I have been using this query on the User has roles table.

user.active=true^user.last_login_timeRELATIVEGT@dayofweek@ago@365^user.internal_integration_user=false^role.nameIN{fulfiller roles}

This gives me all users who have one of the roles identified in our account reps report, have logged in within the last 365 days, are not internal integration users, and are active.

I then used the Task table with a similar query to get all tasks that have been assigned to a user who has one of the roles listed, logged in within last 365 days, not an internal integration user, and is active.

I then used the Python Pandas library to take the two sets of users, merge them with what is essentially a left inner join, which gets all users who have never been assigned to any Task (Incidents, Requests, etc.) and have one or more of the highlighted roles.

       LEFT                                                           INNER LEFT                                                            RIGHT

(users with roles(<-users who have never been assigned to a task)tasks assigned to users with roles)

I'm trying to understand if there are any other criteria that would make someone a fulfiller that I'm not thinking about. 

I appreciate any incite!

[Rafael Batistot]

Hi @JakeBaynes 

Here some suggestions to refine the process

1. Automate the analysis
   – Instead of relying on CSV exports, you can build reports or dashboards directly in ServiceNow (Performance Analytics or list reports). That way, the analysis is repeatable and always up to date.
2. Define access tiers
   – As you mentioned:
   
• Group A → read/comment only
• Group B → full write access
  – You can create wrapper roles (e.g., x_company.reader, x_company.writer) and assign groups to those. Makes it easier to manage long term.
3. Role expiration policy
   – Use Scheduled Jobs to check for users inactive for X days and automatically remove roles/groups.
   – You could also add a Flow Designer flow or UI Action to trigger approvals before removal if needed.
4. Document role scope
   – Keep track of which roles are “core ITIL” vs. which are instance-specific/custom. This helps justify cleanups and design your new access model.
5. Pilot before mass cleanup
   – Apply the new grouping model to a subset of users first and verify they can still perform required tasks without breaking workflows.