In cmdb_ci_appl table, how to allow only the record's Support group to edit that particular record?

[AbdurRahmanSnow]

Good morning.
On the cmdb_ci_appl table, we have lot of application records. So, only people with cmdb_admin and cmdb_manager should be able to edit the records. Apart from these, other people should only read it.
So, I have written 2 ACLs: Write operation (Form level) and List_view operation (List level), and have given these 2 roles. It is working perfectly fine.

The other requirement is to also allow "Support group" people (screenshot below) of that particular record to be able to edit it? (It can be any record.)
How can we do it, keeping in mind of the 2 ACLs, I created? Can it also be done using ACLs? Please help.
Example as below: 

@Ankur Bawiskar @Dr Atul G- LNG @Viraj Hudlikar 

[Dr Atul G- LNG]

Hi @AbdurRahmanSnow 

For me, it sounds a bit contradictory. On one hand, you're saying that only the CMDB Manager or Admin can edit the record, and on the other hand, you're assigning a group that might only have the ITIL role—or something even lower.

Yet, users from that group are still able to make changes.

To me, this seems more like a role mismatch. If needed, either give them the admin or manager role, or create a new ACL. Just keep in mind:

• Even if the group is assigned as a support group,

• You need to check what role is actually required to make changes to that specific record type,

• And whether that role is granted to the group in question.

[Ankur Bawiskar]

@AbdurRahmanSnow 

you can have another table.None WRITE ACL which checks if logged in user is member of that support group using advanced script or conditions

Support Group [IS Dynamic] One of My Groups

In the roles section give snc_internal role

If my response helped please mark it correct and close the thread so that it benefits future readers.

[Ankur Bawiskar]

@AbdurRahmanSnow 

Thank you for marking my response as helpful.

If my response helped please mark it correct and close the thread so that it benefits future readers.

[Viraj Hudlikar]

Hello @AbdurRahmanSnow 

The simplest way is to create a new write ACL on the cmdb_ci_appl table with a script that checks if the current user is a member of the "Support group" specified on the record. Same has been also mentioned by Ankur, give a try and let us know if it works or not.

If my response has helped you hit helpful button and if your concern is solved do mark my response as correct.

As per new community feature you can mark multiple responses as correct.

Thanks & Regards
Viraj Hudlikar.