Access control to projects and portfolios

[airtonvargas]

Hello dears,

We are starting to use the PPM module in our organization and one of the requirements is to control access to projects and portfolios, so that only the PMs can see their own projects and/or only portfolio managers can see the demands/projects in a specific portfolio. Would that be the standard functionality or have a possibility to configure, maybe via access groups?

Thank you,

Airton

[Lauri Arra]

The access to table pm_project is given to role it_project_manager with an ACL entry that has no conditions. For a simple case of making the access conditional, there are three options:

1. add a condition to the ACL that grants the read access to project managers
2. create a before query business rule to limit the database query results
3. Add a definition in the data filtration (study well before trying this)

In addition to these options, you can also create Teamspaces, which provide organisational silos for project access. Teamspaces are not exactly what you were looking for, but had to mention it as well.

Please note that you should first fully understand the business reason for limiting the visibility to other projects. Modifying the access to table pm_project is not enough if the projects are strictly classified, since most of the project's data exists in other tables.

Some of the data on projects is shared by nature. For example, the financials and resource management data is difficult to restrict because they're designed to be shared with other functions.

Limiting the access to one table might seem simple on the surface, but since projects are made up from countless tables, I would sincerely recommend that you consult an experienced implementation specialist before making a decision to pursue this requirement.

I hope this answer helped! Here's also a couple of links on the concepts I mentioned above:
Query BRs vs ACLs: https://www.servicenow.com/community/developer-articles/query-business-rules-vs-acl-comparison/ta-p/... 
Data filtration (SN Docs): https://docs.servicenow.com/bundle/washingtondc-platform-security/page/administer/security/concept/d... 

[airtonvargas]

Hi Lauri,

Thank you for your response. The business reason for hiding some of the projects is that for demands and projects related to M&A (mergers and acquisitions), we cannot make them visible to the entire organization, thus the PMs should see only those projects they are assigned to and the M&A portfolio should be visible only to a selected and handful group of people, due to its sensitivity. With that in mind, we considered the possibility of creating a portfolio that only the portfolio managers assigned it could see the projects details. Would that be possible?

Thank you!