User with itil role not to modify CI

[Giri6]

I find any user with itil role is able to modify existing configuraiton items(CI). But I see itil role has nested role cmdb_read only not write. Not sure any other nested rule is giving update access. If I need to take away modifying CIs, what is the way? Appreciate it.

[Jaspal Singh]

Yes, it will unless at the child table you externally specify it to be overriden.

So its kind of Dictionary override that we normally use. So, if at CI table level if a field is mandatory/read-only for a child table an additional ACL can be in place of write that will allow editing for the child table only.

[Pradeep Sharma]

Access controls (ACLs) can seem very intimidating when you are trying to configure your instance security rules. This article is intended to help understanding and eventually mastering the ACLs usage.

https://hi.service-now.com/kb_view.do?sysparm_article=KB0541355

[Giri6]

This is a good link. It shows the first gate is field level access and the second gate is table-level access.

somehow my class material shows the reverse the evaluation of ACL. First table level and then field level.