How to make fields editable on task level on sc task table

[satya kasina]

I have a requirement in service catalog that I have to populate two fields to only the fulfilment team at the task level and I have to hide the variables on the portal. And the unique qualifier I was using is the catalog item name and the task description and the user has itil and I want those fields to be editable till closed complete state. Actually the issue is if in open state once the values are given into those fields and the form gets saved it is not working. And to get the catalog item I am using getDisplayValue method. And in ui policy I can't make this achievable. What can be the best approach? 

[vaishali231]

Hey @satya kasina 

Relying only on UI Policies will not work reliably for your requirement—especially after the form is saved or reloaded.

 1. Hide Variables on Portal 

Do NOT rely on User Criteria for this requirement.
User Criteria controls catalog/item access, not fine-grained variable visibility per role.

 Use Catalog Client Script 

function onLoad() {

   if (!g_user.hasRole('itil')) {

       g_form.setDisplay('variable_name', false);

   }

}

 Works on Service Portal / Employee Center
  Role-based control
  Reliable after reload

 2. Control Field Access at Task Level (sc_task)

This is the most important part of your solution.

Create a Field-level Write ACL on your fields (for example: u_field1, u_field2).

 ACL Script

answer = false;
if (gs.hasRole('itil')) {

   if (current.request_item.cat_item == 'YOUR_CAT_ITEM_SYS_ID') {

       if (current.state != 3) { // Closed Complete

           answer = true;

       }

   }

}

 This ensures:

• Only fulfilment users (ITIL) can edit
• Fields are editable only until Closed Complete
• Works consistently across:

Form

Portal

API / integrations

 3. UI Behavior

Use a Client Script only for better user experience (not security).

function onLoad() {

   var state = g_form.getValue('state');

   var isITIL = g_user.hasRole('itil');

   if (isITIL) {

       g_form.setDisplay('u_field1', true);

       g_form.setDisplay('u_field2', true);



       if (state != '3') {

           g_form.setReadOnly('u_field1', false);

           g_form.setReadOnly('u_field2', false);

       } else {

           g_form.setReadOnly('u_field1', true);

           g_form.setReadOnly('u_field2', true);

       }

   } else {

       g_form.setDisplay('u_field1', false);

       g_form.setDisplay('u_field2', false);

   }

}

 Improves usability
Not a security layer (ACL already handles that)

 4. Business Rule (Use Only If Needed)

In most cases, ACL is sufficient and you can skip Business Rules.

If you still need server-side validation, scope it only to your fields:

if (current.state == 3) {

   if (current.u_field1.changes() || current.u_field2.changes()) {

       gs.addErrorMessage('Fields cannot be modified after Closed Complete');

       current.setAbortAction(true);

   }

}

 Prevents unwanted updates
  Avoids blocking unrelated field changes

 5. Correct Way to Identify Catalog Item

 Avoid:

current.request_item.cat_item.getDisplayValue()

 Use:

current.request_item.cat_item == 'SYS_ID'

 Stable and reliable
  No dependency on display values

************************************************************************************************************************************

If this response helps, please mark it as Accept as Solution and Helpful.

Doing so helps others in the community and encourages me to keep contributing.

Regards

Vaishali Singh

[Ankur Bawiskar]

@satya kasina 

My approach

->  Hide those two variables on the portal/catalog item using a Catalog UI Policy that applies only to the catalog item or Service Portal view.

-> Show them on sc_task using a Catalog UI Policy that applies on Catalog Tasks only, and make them editable with g_form.setReadOnly('variables.your_variable', false)

-> Enforce edit access for fulfilment users until Closed Complete with an ACL, because ACL is the reliable layer for “only ITIL / fulfilment team can update these fields.”

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[Tanushree Maiti]

Hi @satya kasina 

1. Use Catalog UI Policy to make catalog variable editable for sc_task.

1. Navigate to Service Catalog > Catalog Policy > Catalog UI Policies.
2. Click New.
3. Applies to:  Catalog Task
4. Catalog Item/Variable Set: Select your specific Catalog Item or Variable Set.
5. Conditions: Define when the variable should be editable 
6. Reverse if false: Check this if you want it to become read-only again if the condition is not met.
7. Save the record.

Configure UI Policy Action:

1. In the Catalog UI Policy Actions related list, click New.
2. Variable name: Select the variable you want to make editable.
3. Read only: Select False (to make it editable).
4. Mandatory: (Optional) Set to True if it must be filled in before closing the task.
5. Visible: Select True.
6. Click Submit.

B. Ensure there is  UI policy (on catalog task) ->UI policy action, which is making sc_task variables readOnly once sc_task is closed .