I created an article with a knowledge block in our test instance. The article is in our self service knowledge base which is not restricted at all, but the knowledge block has a restricted audience. I set "can read" on the block to only for members of our IT group since the knowledge block contains technical info. I tested it by impersonating a user who has zero ServiceNow access besides our service portal and it worked fine. I sent the article link to my manager and he impersonated someone who is not part of the IT group and reported that she was able to see the knowledge block even though she shouldn't.
I ran user criteria diagnostics, which confirmed she does not have access to the knowledge block, and yet when I impersonated her, the block did appear in the article. There were a couple other weird things when I impersonated her. She had strange access in ServiceNow - for example she was presented the checkout button on the article although she should have zero access to do so. In addition, her user menu/name did not appear on the banner. I checked her groups/roles, and she does not have any knowledge or itil type role.
I tested a couple other users and experienced mixed results. It seems folks who have access to any knowledge in any capacity other than the service portal can see this knowledge block even though user criteria diagnostics say they don't have access. What am I missing?
We do not have any ACL's or user criteria in place at the article level. All restrictions are at the knowledge base level and/or knowledge block level. This makes no sense to me.
