Why Can Users Without Roles See the “New” Button in Data Table Widget?

[天宇石]

I’m using the widget-data-table in the Service Portal to display a list of Incidents.
However, users without any roles can still see the “New” button and are able to create new Incident records.

Why is this happening, and how can I fix it?

[Tanushree Maiti]

Hi @天宇石 

Users without roles creating incidents often stems from missing Create Access Control Lists (ACLs) on the Incident table or unconfigured UI actions in Service Portal.

To restrict access, create a Create ACL on the incident table restricting access to snc_internal /itil roles as per your requirement.

Refer: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1443658

[Ankur Bawiskar]

@天宇石 

the OOTB Table.None CREATE ACL on incident must be allowing access and hence NEW button is seen

Did you check by using Access Analyzer if that user has CREATE ACCESS or not?

Get the right access, faster: How Access Analyzer helps you work smarter 

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[Ankur Bawiskar]

@天宇石 

Hope you are doing good.

Did my reply answer your question?

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[天宇石]

@Ankur Bawiskar 

In my instance, the snc_internal role is not included in the Requires role of the ACL you mentioned. It is still OOTB, and I haven’t modified anything.