We need data managers that don't have cmdb admin role.

[Robert Campbell]

We have a team that manages data certification but now that it's being moved into the CMDB workspace you need the cmdb admin role to manage data certification and attestation (which I feel is absurd). 

Would we need to create custom ACLs to make this possible or is this not possible at all?

[Robert Campbell]

Not directed towards you but that is foolish. It's a data manager role and there's a data_manager_admin role to represent that but that role doesn't allow you to do data manager admin things like create data policies.

Data Manager should have access to the Data Manager link/section/workspace. And we shouldn't have to create a custom ACL to get that.

[Matthew Frazier]

Haha! Very funny. The thought that customers would or should customize this highly complex workspace to grant access to a new role. It's not the same as just creating an ACL.

ServiceNow did a terrible job in defining these roles and this new data certification function. The underlying tables seem to allow reads with data_certification_user and creates with data_certification_admin, but the CMDB Workspace requires the sn_cmdb_admin role to view the Management tab where these functions / forms are actually configured for use.

[Robert Campbell]

The problem is the ServiceNow user base doesn't consist of only admins and customers. There are super admins, admins, managers, agents, users and customers (and maybe a few more). Data managers aren't restricted to CMDB data. Data Certification isn't restricted (and shouldn't be) to CMDB data.