Hi there,
We currently have a situation where users with the service_editor role are able to modify CI relationships on the CMDB. I have locked this down using create and write ACLs on the cmdb_rel_ci table.
While this does work, the "Add CI Relation...