How to give write access to a single field?

JLeong · ‎12-17-2020

Hi there, I am working on giving a group of users edit access to the Invoice Number field in the asset table. Here is what I have done so far.

- I created a role called - asset_inv_nbr_update
- I added the group of users to the role
- I created a Write ACL in the Invoice Number field
- I added the asset_inv_nbr_update role to the ACL

The above doesn't work. So I added the role to the Write ACL within the Asset Table but it opens up a lot of fields. I am not sure about the next step. Do I need to add ACLs for each field?

Thanks!

Allen Andreas · ‎12-17-2020

Hi,

The way ACLs work is that you can think of a table...like a house. So the house is the Asset Table. The rooms inside represent the fields on the table. So you have given them access to a room inside the house, but they need to be able to go in the house first.

So you'd want to give write access to the table and to the field.

BUT, you'd also need to modify that write access to NOT be everything (as you've seen).

So to assist with this, you'd want to edit the OOB write ACL, but this time for * (meaning all other fields)...and set that role on that ACL to the normal role that is required for that table or should be required for this table (asset role). This basically says hey members of this special group...you can write to this table....BUT...modified...to only the field or fields I say (via new write acl for table.field).

When do a an ACL for table.* it basically means: for all other fields this ACL applies UNLESS I create an ACL for a specific field, then use that.

So here's the steps you did:

- I created a role called - asset_inv_nbr_update
- I added the group of users to the role
- I created a Write ACL in the Invoice Number field
- I added the asset_inv_nbr_update role to the ACL

Now here's a few more:

- Create a write ACL for the entire table specifying this role you made (as you did, so keep it or re-add it back)
- Edit the write ACL for the table.* to only include the role of users who SHOULD be able to write to this table to all other fields (asset role).

Since there's already a table.* ACL, that is why I'm saying edit it...because that ACL, currently, lets anyone write to all the fields on the table with no role as long as you have table write privilege (which they would through the new table acl you're making for them).

So this allows them to come in to the house, but only to 1 room. All other rooms are locked.

Please mark reply as Helpful/Correct, if applicable. Thanks!

Please consider marking my reply as Helpful and/or Accept Solution, if applicable. Thanks!

View solution in original post

Andy Smith2 · ‎03-09-2021

Thanks Allen.

Appreciate your advice and quick response.

I will create a new question in future - I'm pretty new to ServiceNow and need to learn the protocol for working with the Community.

Many thanks

Andy

Allen Andreas · ‎03-09-2021

Hi,

It's no problem at all. Did my reply above answer your question though?

Just wanted to make sure you're good to go 🙂

Please consider marking my reply as Helpful and/or Accept Solution, if applicable. Thanks!

Andy Smith2 · ‎03-11-2021

Hi Allen

Just to let you know that I've got this working, with 3 ACs as per your advice, giving me control at the record and field levels exactly as I want it to.

I'm very grateful for your advice and assistance - much appreciated.

In case anyone else has the same challenge, I also found this documentation to be helpful:

https://developer.servicenow.com/dev.do#!/learn/learning-plans/paris/servicenow_application_develope...

Cheers

Andy

Allen Andreas · ‎03-11-2021

Hi Andy,

Awesome, great work!

Thanks for the feedback as well.

-Allen

Please consider marking my reply as Helpful and/or Accept Solution, if applicable. Thanks!

Rajanmehta · ‎04-27-2021

Hi Andy,

That documentation was so crystal clear. Really great. I had taken the admin class couple years ago, but always had confusion about ACL. But now I am pretty clear.

Thanks for posting this link.

On the other note, how would I restrict visibility at row level? ( i.e. If I have to restrict certain kind of records )