Restrict few Knowledge bases to 2 roles

[Lucky1]

Hello all,

I have a requirement where 2 Knowledge bases (kb_knowledge_base) has to be restricted for both Knowledge manager and Knowledge admin. Apart from those 2 Knowledge bases, they should be able to see all others.
But I have created a group, where those 2 knowledge bases can be seen by the group members.

I have modified the existing oob ACL, but it's not working. 
Below is my script:
ACL: kb_knowledge_base -- None
Role: itil
Script:

var kbKnowledge = new KBKnowledgeBase();

// Allow bulk/system updates

if (kbKnowledge.isMultipleKnowledgeUpdate()) {

    answer = true;

}

// Always allow admin (safety)

// Always allow admins

if (gs.hasRole('admin')) {

    answer = true;

}

else {

    var restrictedKBs = [

        '9d9f2ab3c3b50e90f07c3be6050131d0',

        '246cdc43dbf1341015c8e16c0b9619ca'

    ];

    var allowedGroup = '23a619c7c3f07e508c405883e401312a';

    var kbId = current.kb_knowledge_base + "";

    if (restrictedKBs.indexOf(kbId) > -1) {

        if (gs.getUser().isMemberOf(allowedGroup)) {

            gs.log("KB Article Allowed for group");

            answer = true;

        } else {

            gs.log("KB Article Restricted");

            answer = false;

        }

    } else {

        gs.log("KB Article Allowed for all");

        answer = true;

    }

}

But this is not working because when I impersonate the users and check only last log is coming up. that is, KB Article Allowed for all.

So, can someone help on this please?

Regards,

Lucky

[Tanushree Maiti]

Hi Lucky ,

Step1: 

• Navigate to Knowledge > Administration > User Criteria.
• Create a new User Criteria (e.g Exclude Knowledge Managers/Admins ).
• In the Advanced tab, use a script to check if the user has one of these roles.

Step2:

• Navigate to Knowledge > Administration > Knowledge Bases.
• Open the 2 restricted Knowledge Bases.
• Navigate to the Can Read related list.
• Remove any specific roles (knowledge_admin, knowledge_manager as per your requirement) that allow general access.
• Add the specific group or user criteria created in step 1 that defines who can access it.