ACL deny read on single record

[Julian12]

I'm trying to simply deny read access to a record on the cmdb_ci. But not even puting answer = false; on the script area is restricting access to users...

Any ideas on what I'm doing wrong
This is the ACL

But any ITIL user is having access to the record:

[Tony Chatfield1]

Hi, have you enabled security debugging, reproduced the issue and reviewed your security logs?
ACL debugging tools (servicenow.com)

I would expect that there are existing OOB ACL's that are allowing access to this record, and these ACL's would also need to be updated as access is allowed as long as 1 ACL has conditions that are met.

[Julian12]

Hi There Tony! Thanks for your help!

I'm trying to debug although without succes since the debugger shows 3 ACLS granting access to the field although I can not find them in the ACL table... I'm pretty sure I'm doing something wrong since this is my first time debugging ACLS,,, see picture below...

Showing 3 ACLS...

No acl .configuration_item in ACL table:

[Badal Khojare]

Hi @Julian12 , This ACL mostly likely is dynamically evaluated at runtime so might not be an static entry in ACL table. The evaluation might depend on current context such as your role, system state or other variables.

[Julian12 · Accepted solution]

Resolved by myself:

There was another ACL grating access to the entire cmdb_ci table, had to add a filter to bypass the actual CI record using sysID and created another ACL with a condition on the same CI and the script:

var answer = true
var grDeniedGroup = new GlideRecord("sys_user_group");
grDeniedGroup.addEncodedQuery("query with groups if user is member of then wont have access");
grDeniedGroup.query();

while (grDeniedGroup.next()) {
    if (gs.getUser().isMemberOf(grDeniedGroup.name)) {
        answer = false;
break;
    }
    else {
        answer = true;
        }
}