ACL to restrict editing of Assignment Group on Incident Table List View

Chad Wilhelm1
Tera Expert

Hello,

We have a requirement to allow list edit on assignment group to only certain groups.   I have figured out how to allow the groups to edit list view but all fields are editable any suggestion without having to create additional ACL's to lock down all the fields except assignment group?   Any assistance is greatly appreciated.

find_real_file.png

 

1 ACCEPTED SOLUTION

Michael Ritchie
ServiceNow Employee
ServiceNow Employee

Your existing ACL that you show above will grant access at the record level and to define a specific field restriction you will need a single additional ACL defined to the Assignment Group where condition answer gets set to false.

 

Look at the out of the box ACL on chat_survey.type as an example:

find_real_file.png

View solution in original post

4 REPLIES 4

Michael Ritchie
ServiceNow Employee
ServiceNow Employee

Your existing ACL that you show above will grant access at the record level and to define a specific field restriction you will need a single additional ACL defined to the Assignment Group where condition answer gets set to false.

 

Look at the out of the box ACL on chat_survey.type as an example:

find_real_file.png

So I would have to define ACL's I want to restrict access to?  This would mean I would need to create 40 to 50 ACL's One for each field.  This is what I was trying to avoid.   Let me break it down

List Edit for Assignment Group ONLY to EIS Application Engineering

Any other group no capability to edit ANY fields in list

EIS Application Engineering cannot edit any other field in list view EXCEPT Assignment Group.

Thanks,

Chad

You misunderstood what I am saying.  ACLs by default are deny first meaning you don't have CRUD (create, read, update/write, delete) access unless granted by an ACL.  It might be worth understanding how ACLs are processed:

https://docs.servicenow.com/bundle/helsinki-platform-administration/page/administer/contextual-secur...

As mentioned in the doc diagram it starts at fields and works it's way backwards on a field by field basis to the table and so on.  So if your use case is that no one should be able to list edit, then you need an ACL that denies access to list edit.  I put ITIL as a role in case you only wanted this to impact ITIL roled usersfind_real_file.png

 

The above will not allow anyone with the ITIL role to list edit.  Then for your use case of 1 specific group allowing update to the assignment group field, you then create one additional ACL to grant that access since again ACLs process fields and work inwards to the table:

find_real_file.png

For an specific group of users, the script not working