Preview Record of a Reference Field Allows Users to Edit Their Records Through Catalog Form

[Irene M]

Hi everyone!

I need help figuring out how to fix this issue.

We just discovered that users (both ITIL and non-ITIL) can update their own records by clicking the "i" icon beside a field in the catalog form. This field is a reference field that points to the sys_user table.

Our requirements are:
        1. Non-ITIL users should not be able to update their records. All fields must be read-only.
        2. ITIL users should only be able to update their mobile phone number. All other fields must be read-only.

How can we achieve this? I appreciate any suggestions or guidance. Thanks in advance!

[ajmalmuhamm]

Hi @Irene M ,

Hi @Irene,

Since the reference icon opens the sys_user record, access is controlled by ACLs, not by the catalog item itself.

A good approach would be:

• Create a table-level Write ACL on sys_user that allows the appropriate ITIL users to update user records.

• Create a field-level Write ACL on sys_user.mobile_phone that allows those ITIL users to edit only the Mobile Phone field.

• Create a field-level Write ACL on sys_user.* that denies write access to all other fields.

For non-ITIL users, simply ensure they do not have write access to the sys_user table, so all fields remain read-only.

You'll need the security_admin role to create or modify ACLs. If you don't have it, you'll need to work with your ServiceNow administrator.

I hope this helps! If you have any questions or run into any issues implementing it, feel free to ask.

[Irene M]

Hi @ajmalmuhamm thanks for responding. Something we forgot to consider is that we have an automation from ActiveDirectory that writes user information in our sys_user table. When I did this, it blocks ActiveDirectory leaving newly created user with empty information such as Name, title, email, etc. basically all the fields that we deny write access.