We created a business rule to restrict Risk and Risk acceptance task to search if logged in user is not the same as the owner and assigned_to.
sn_risk_risk - Owner
(function executeRule(current, previous /*null when async*/) {
// Allow admins and users with specific roles to bypass the restriction
if (gs.hasRole('admin') || gs.hasRole('sn_risk.global_manager') || gs.hasRole('sn_grc.admin')) {
return;
}
var user = gs.getUser();
var userRecord = new GlideRecord('sys_user');
if (userRecord.get(user.getID())) {
var userCountry = userRecord.location.country;
// If user's country is defined, filter the query
if (userCountry) {
// Add condition: Owner's country must match user's country
current.addQuery('owner.location.country', userCountry);
} else {
// If user has no country, restrict all records
current.addQuery('sys_id', '');
}
} else {
// If user record not found, restrict all records
current.addQuery('sys_id', '');
}
})(current, previous);
sn_risk_acceptance_task
(function executeRule(current, previous /*null when async*/) {
// Allow admins and users with specific roles to bypass the restriction
if (gs.hasRole('admin') || gs.hasRole('sn_risk.global_manager') || gs.hasRole('sn_grc.admin')) {
return;
}
var user = gs.getUser();
var userRecord = new GlideRecord('sys_user');
if (userRecord.get(user.getID())) {
var userCountry = userRecord.location.country;
// If user's country is defined, filter the query
if (userCountry) {
// Add condition: Owner's country must match user's country for the task
current.addQuery('assigned_to.location.country', userCountry);
} else {
// If user has no country, restrict all records
current.addQuery('sys_id', '');
}
// Check if the risk acceptance task has an associated parent risk
if (current.risk) {
var parentRisk = new GlideRecord('sn_risk_risk');
if (parentRisk.get(current.risk)) {
// If the parent risk exists and has an owner
var parentRiskOwnerCountry = parentRisk.owner.location.country;
// If the parent risk owner is from a different country, allow access to the task
if (parentRiskOwnerCountry !== userCountry) {
// Allow access to the risk task even if country mismatch exists
current.addQuery('sys_id', current.sys_id); // Ensure the task remains accessible
}
}
}
} else {
// If user record not found, restrict all records
current.addQuery('sys_id', '');
}
})(current, previous);
However, there are cases that when the Owner of the Risk assigned the risk acceptance task to user that located in other country. So the assigned_to cannot view the Parent risk.
Sample this Risk.
Owner is from Korea
And the risk acceptance task is assigned to Scott that is located in the US.
So Scott cannot view the parent risk because him and the owner are not in the same country.
How can I exempt that case in my BRs?
