Zurich Release - Is Conditional Script Writer Group needed for admins? or can we disable it for all?

[RC19]

Hello All,

Have anyone completed their Zurich upgrade? we see new group "Conditional Script Writer" and it's role getting auto assigned to all existing users and new users created. I have already made "glide.security.scripting_role.auto_provisioning" property to false .

Below statement from support doc says that even admins cannot edit scripts if this role is not given to them but when i have tested that currently admins are able to edit scripts even without this role/group

How have you completed Zurich upgrade in your instance? please suggest on how you handled this new role/group feature in your instance and what is the best way... Why should admins need such role and why non admins should even edit scripts ?

[Ankur Bawiskar]

@RC19 

My thoughts

-> This feature prevents unauthorized or accidental script changes, improving platform security and compliance. Non-admins should not edit scripts unless explicitly required for development.

-> allow- only users, who is knowledgeable enough, to have access to modify scripts

check this

Scripting Governance Tool 

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[RC19]

Hi Ankur,

Thanks for that document. it was helpful. However, I observed one more thing that if any user is not given this role, then they won't be able to edit any html fields as well(which we mainly see in Problem form). So indirectly this role needs to be given to all users. Else maybe we need to edit the OOB acts. Any views on this ?

[Ankur Bawiskar]

@RC19 

I don't have any Zurich instance so can't check.

But if you are pointing this out, then mostly it means it's not working as expected as per OOTB feature.

[Victoria Drobys]

Hi @RC19 

Based on my experience with Zurich, I recommend adding this role for users who already have the following roles

1. admin - since admins usually work with all types of scripts;

2. itil -because ITIL users need access to HTML fields (as you mentioned in Problem form);

3. knowledge - because the Knowledge Article body is an HTML field

And this is a bare minimum for the ITSM. 

ServiceNow recommended to include this role to the groups (not into the roles directly)

It’s a weird concept, but I don’t see any better option. HTML fields are used everywhere in the instance, and even though assigning access user-by-user sounds nice in theory, it just doesn’t work in real life.

I hope my reply helps. Thank you