Is it possible to restrict access to attachments on ServiceNow records?

[jonw1]

Our technicians would like to attach a file to an incident or request (for example), but somehow limit the visibility of that attachment.     Is it true that anyone who has access to a given record will be able to open any attachments on that record?     Or is it possible to limit this access somehow?        

[carolina2]

Its possible to restrict access to attachments via ACL

[jonw1]

Thanks Carolina.     So I guess that (ACLs) is going to provide yes/no access to attachments, but not the flexibility to grant access o a case-by-case basis.     I think our techs would like to make a choice whether an attachment is "public" or "private."

[rlatorre]

In order to secure your attachments as "private" you can store them on your network (controlling access to a shared directory) and attach a .url attachment to the ServiceNow record. We built similar functionality for contracts and other sensitive financial information.You can also attach web URLs (http).

You'll need to modify the attachment UI page. I can supply the code if you are interested.

Note: Doing this will exclude that page from patches and upgrades. You should compare new code delivered from SN to these modifications.

[DilipKumar DJ]

Hi Jon,

In that case you need to restrict via Business rule (before - Query) and use your public/private condition every time it queries.