Ability to read the Parent Security Incident by all users from the group assigned to its child SIT

gthapa · Thursday

Hello Community,

I’m working on creating an ACL that grants a group access only to the parent Security Incident (SIR) of a Security Incident Task (SIT) assigned to that group.

Currently, the group has only the sn_si.external role, which allows them to view only their assigned SITs but not the related parent SIRs. My goal is to implement an ACL that enables the group to view the parent SIR corresponding to any SIT assigned to them.

I prefer not to use the built-in “Read Access” feature on the SIR form since it grants access at the user level, not the group level. Therefore, an ACL seems to be the most suitable approach.

Connectmustaq · yesterday

Hi @gthapa ,

To allow a group with only the sn_si.external role (which currently lets them view only assigned Security Incident Tasks, SITs) to also view the parent Security Incident Request (SIR) records corresponding to those SITs assigned to the group, creating a custom ACL on the SIR (sn_si_incident) table is an effective solution.

Approach for ACL on Parent SIR Based on SIT Group Assignment

Create a record-level ACL on the sn_si_incident table that grants read access only if the current user’s group matches the assignment group of any associated child SIT.

Points to remember

Efficiency: Make sure indexes exist on sn_si_task.parent and sn_si_task.assignment_group for performance.
Test: Test thoroughly for edge cases with multiple SITs per SIR and groups.
Security: Keep the ACL strict—deny access if no matching group SIT is found.
User Roles: Make sure the users are assigned correct groups.

This ACL method provides group-level controlled access to parent Security Incident records based on child task group assignment without relying on user-level “Read Access” form configurations.

If it is helpful, please hit the thumbs button and accept the correct solution by referring to this solution in the future it will be helpful to them.

Thanks & Regards,

Mohammed Mustaq Shaik

Ability to read the Parent Security Incident by all users from the group assigned to its child SIT

Hi @gthapa ,

Approach for ACL on Parent SIR Based on SIT Group Assignment

Create a record-level ACL on the sn_si_incident table that grants read access only if the current user’s group matches the assignment group of any associated child SIT.

Points to remember

Efficiency: Make sure indexes exist on sn_si_task.parent and sn_si_task.assignment_group for performance.

Test: Test thoroughly for edge cases with multiple SITs per SIR and groups.

Security: Keep the ACL strict—deny access if no matching group SIT is found.

User Roles: Make sure the users are assigned correct groups.

This ACL method provides group-level controlled access to parent Security Incident records based on child task group assignment without relying on user-level “Read Access” form configurations.