Grant write rights to a single field with Field level ACLs

[GabrielCSSMI]

I need to grant write access to a certain field within the cmdb_software_product_model table to a custom role I created. This access must be restricted conditionally to some records of the table meeting criteria based on the "Manufacturer" field.

It is my understanding that in order to do that, table and row access must be granted as well.

I've created 3 custom ACL rules on the cmdb_software_product_model table as such:
- Write - cmdb_software_product_model.none

- Write - cmdb_software_product_model.*

- Write - cmdb_software_product_model.name

All of these rules require the custom role I created and are filtered on the "Manufacturer" field. Doing so grants write access to the whole table. Without the row level ACL, the whole table still has write access. Without the table level ACL, none of the fields have the write access.

The OOB write rule for this table is still there, since it's not filtered I'm not using it. I tried adding my role to this rule, it still grants write access to the whole table even though I have my row level and field level ACLs configured.

What else can I do to grant write access to the name field only? Thank you.

[Ankur Bawiskar]

@GabrielCSSMI 

if user gets table.name WRITE then table.* won't be evaluated.

- Write - cmdb_software_product_model.none this is required since it's table level

[GabrielCSSMI]

Hi,

I've tried having only cmdb_software_product_model.none and the cmdb_software_product_model.name, the user is granted write access for the whole table.

Is there something I'm missing? Thank you.

[Ankur Bawiskar · Accepted solution]

@GabrielCSSMI 

you don't want that user to edit any other field other than name?

if yes then ensure you block table.* write acl for that user

[GabrielCSSMI]

Thank you, I just assumed ACLs applied restrictions if a smaller scope was specified, this worked for me!