Problems with watch list user permissions out of the box

[jamesmcwhinney]

While running some tests in preparation to roll out ServiceNow to our users next month, I noticed that when an end user is added to the watch list of an incident, they can open the incident in a read only state, which makes sense.

However, they are also able to cancel the incident, which does not make sense.

Is there an easy way to correct this? (via ACL, UI policy, etc) ?

I am struggling with this since I cant seem to track down what is giving the watch list users read only access in the first place.

Thanks!

- James

[manikorada]

James,

There is a ACL which is : https://<<instance_name>>.service-now.com/nav_to.do?uri=sys_security_acl.do?sys_id=7da3bda1c0a801667dc88c1e9527f776

This is giving read access for the Watch List users.

For cancelling the incident, if you are using UI action add a condition in the UI Action to allow only users whom you need to

[jamesmcwhinney]

Thanks Mani,

I am still a little confused by this.

If the ACL is only allowing the user "read" access but not write access, how is it that the user is able to cancel the incident?

Since cancelling the incident means updating the status field of the record, isn't that considered a "write"?

How is this possible?

Do UI actions completely override the ACL permissions?

Thanks again,

- James

[manikorada]

James,

How are users canceling the incident? Can you provide the screenshot of the UI action if you are using that

[jamesmcwhinney]

0Hi Mani,

The scenario is that user A (a regular end user) logs an incident.

User B (also a regular end user) is added to the watch list.

User B then opens the incident and cannot edit it, but can somehow still cancel it.

This is the OOTB setup as far as I know, but I don't think it makes sense for watch list users to be able to cancel the incident.

Thanks again,

- James