How to restrict updates on “Closed” Incidents in ITSM?

[vickythakur]

Spoiler

Hello Community, We have a requirement in ITSM where once an Incident record is moved to the Closed state, it should become read‑only for all users except Administrators. Currently, users can still update fields after closure, which is causing audit concerns. What is the best way to enforce this restriction — should we use a Data Policy/UI Policy or an ACL?

[Dr Atul G- LNG]

ACL is best to do mate.

https://www.servicenow.com/community/itsm-forum/make-2-fields-editable-on-incident-form-when-inciden...

https://www.servicenow.com/community/itsm-forum/writable-field-on-incident-is-readonly-for-all-users...

[surajsengar]

@vickythakur 

This is a common ITSM governance requirement, and the best practice is to use ACLs (Access Control Lists) for enforcement, with optional UI Policies for user experience.

ACLs (Recommended):

ACLs operate at the server level, so they apply regardless of how the record is accessed (UI, API, integrations, imports).

You can configure a Write ACL on the Incident table with a condition like:

Script -

 current.state == '7' && !gs.hasRole('admin')

 Here, 7 is the closed state value. This ensures only Admins can update closed incidents.

UI/Data Policies (Optional):

These make fields appear read‑only in the form, improving user experience.

However, they only apply in the UI and do not prevent updates via APIs or background scripts.

Best Practice:

Use ACLs for true security and compliance.

Complement with UI Policies so users see the restriction visually in the form.

This combination ensures both robust enforcement and a clear user experience.

[Ankur Bawiskar]

@vickythakur 

OOTB users can't edit closed INC. See screenshot below

I am ITIL user and INC is closed and I am unable to edit

Seems somebody customized the OOTB Table.None WRITE ACL on incident table

Use access analyzer and see which ACL is allowing WRITE on CLOSED INC

[Vancouver Release] Customers gain enhanced access visibility with ServiceNow Access Analyzer 

ACLs to check

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏