Preview Record of a Reference Field Allows Users to Edit Their Records Through Catalog Form

[Irene M]

Hi everyone!

I need help figuring out how to fix this issue.

We just discovered that users (both ITIL and non-ITIL) can update their own records by clicking the "i" icon beside a field in the catalog form. This field is a reference field that points to the sys_user table.

Our requirements are:
        1. Non-ITIL users should not be able to update their records. All fields must be read-only.
        2. ITIL users should only be able to update their mobile phone number. All other fields must be read-only.

How can we achieve this? I appreciate any suggestions or guidance. Thanks in advance!

[Kieran3]

Hi @Irene M does the automation have an admin level role? If so, allow admin to override. Or, consider making a new role with no associated permissions and assign it to the automation account and then set the ACL restriction to not apply for that user, allowing it to write.

[Ankur Bawiskar]

@Irene M 

create individual field level WRITE ACL for mobile phone field and allow itil user to edit by giving that role

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[Irene M]

Hi @Ankur Bawiskar, thanks for responding. 

I created a write ACL on the sys_user table. It's working for non-ITIL users—they can no longer write to the table, and all fields are now disabled for them.

However, ITIL users also can't write to the table. We need ITIL users to be able to update only the Mobile Phone field, while all other fields should remain read-only. How can I achieve this?

[Ankur Bawiskar]

@Irene M 

that's what I mentioned

create 1 field level WRITE ACL and add itil role in that

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[Irene M]

Hi @Ankur Bawiskar thanks for responding. Something we forgot to consider is that we have an automation from ActiveDirectory that writes user information in our sys_user table. When I did this, it blocks ActiveDirectory leaving newly created user with empty information such as Name, titlr, email, etc. basically all the fields that we deny write access.