In our environment, we have many non-IT users with ITIL roles. ServiceNow is being used for task assignment for the entire company and all this is run off the Incident table.
(Note: I know how bad this is. I inherited this and did not design it. This question isn't about fixing this, it's about working around it.)
There is a role in our organization simply called "IT." All actual IT users have this role.
What I'm trying to accomplish is to set up an ACL (or other solution) where if an Incident has the "IT Operations" assignment group, only users with the IT role can read or write to the work notes on that Incident. I do not want users with the ITIL role, sn_incident_read, or sn_incident_write roles to see work notes for this assignment group unless they also have the IT role. They should be able to view work notes in other assignment groups w/o impediment.
This feels look it should be easy, but I haven't been able to work it out. It's also very possible I'm just a bad admin. Any help would be appreciated.
