Restrict approvers from editing or deleting attachments on Service Request approvals in Service Port

[Subalakshmi P2]

Approvers are currently able to edit or delete attachments associated with RITMs while reviewing approvals in the Service Portal. Is this an out of the box behavior?

This behavior needs to be restricted. Approvers should be able to view and download the attachments required for approval, but they should not be allowed to edit, rename, or delete those attachments when the attachment belongs to a request or requested item for which they are an approver.

The restriction should apply only to attachments related to the approver’s own approval records. If the same user accesses attachments in other areas where they are not acting as an approver, their existing attachment access should remain unchanged. Please advise if this can be achieved.

[ajmalmuhamm]

Hi @Subalakshmi P2 ,

Yes, this is generally out-of-the-box behavior if the user has write access to the parent record or the attachment. By default, attachment actions (such as rename or delete) are controlled by the underlying ACLs and the permissions on the parent record.

For your requirement, you can achieve it by implementing attachment ACLs or customizing the attachment actions so that:

• Users acting as approvers can view and download attachments.

• They cannot edit, rename, or delete attachments when the attachment belongs to a RITM or Request for which they are acting as an approver.

• Their existing attachment permissions remain unchanged when accessing records where they are not the approver.

The recommended approach is to add conditional ACL logic (or attachment-specific ACLs) that checks whether the current user is the approver for the associated approval record and denies write/delete operations while still allowing read access. This keeps the restriction scoped only to the approval scenario without impacting the user's permissions elsewhere.

[Subalakshmi P2]

hi @ajmalmuhamm 
Thanks for the response.
Can you please provide the detailed configuration details