Restrict Visibility of Incidents to Assignment Groups Using ACLs

[kishoreareg]

We are considering implementing ACL-based access controls to restrict visibility of Incident records assigned to the following assignment groups:

• PSO-PLATFORMS-SOC-L1
• PSO-PLATFORMS-SOC-L2

The requirement is that Incident records assigned to these groups should be accessible and visible only to members of the respective SOC assignment groups (and any authorized security administrators). All other users across the organization should be prevented from viewing or accessing these incidents. We are looking to achieve this requirement primarily through ServiceNow ACLs and would like to understand the recommended approach and best practices for implementation.

[Chetna_Aggarwal]

This can be achieved using a Before Query Business Rule instead of relying solely on ACLs. A Before Query Business Rule filters records before they are returned, ensuring that unauthorized users cannot see restricted incidents in lists, reference lookups, or searches.

You can implement a Business Rule on the Incident table with Before = true and Query = true. The logic would be:

• Allow users with admin or security_admin roles.
• Check whether the logged-in user is a member of either PSO-PLATFORMS-SOC-L1 or PSO-PLATFORMS-SOC-L2.
• If the user is not a member of either group, add a query to exclude incidents assigned to those groups.

Example:

(function executeRule(current) {

    if (gs.hasRole('admin') || gs.hasRole('security_admin'))
        return;

    var groupIds = [];
    var grp = new GlideRecord('sys_user_group');
    grp.addQuery('name', 'IN', 'PSO-PLATFORMS-SOC-L1,PSO-PLATFORMS-SOC-L2');
    grp.query();
    while (grp.next())
        groupIds.push(grp.getUniqueValue());

    var grMember = new GlideRecord('sys_user_grmember');
    grMember.addQuery('user', gs.getUserID());
    grMember.addQuery('group', 'IN', groupIds.join(','));
    grMember.query();

    if (!grMember.hasNext())
        current.addQuery('assignment_group', 'NOT IN', groupIds.join(','));

})(current);

If the requirement is to completely hide these incidents from unauthorized users, a Before Query Business Rule is generally a better choice than using ACLs alone. ACLs prevent access to records but do not always prevent them from being returned by the initial query, whereas a Before Query Business Rule filters them out before the query results are generated.