Field Encryption Module configuration by Script type in Module access policy

[israyalkhan1]

Hi Everyone,

I have a requirement involving Field Encryption (KMF/Platform Encryption) on the Incident table.

- I have created a custom field and want to encrypt it using KMF/Field Encryption.
- The Incident Caller should be able to view/decrypt the encrypted field.
- The current Assigned To user should be able to view/decrypt the encrypted field.
- If the Assigned To user changes, only the new Assigned To user should be able to access the field, while the previous Assigned To user should lose access.
- In short, access should always be granted only to the current Assigned To user and the Caller of the Incident.

Since this requirement is dynamic and record-specific, a role-based Module Access Policy does not seem sufficient because roles are static.

Can this be achieved using Type = Script in a Module Access Policy? Does the policy script have access to the current record context (for example, current.assigned_to, current.caller_id, etc.) during encryption/decryption evaluation? If yes, could someone provide an example or guidance on how to implement it?

If not, what is the recommended and supported approach to achieve this requirement using KMF/Field Encryption?

Thanks in advance!

[Kieran Anson]

Hi,

As far as I'm aware, KMF doesn't operate on this dynamic. Access isn't dynamic based on a record. I think the overhead of that would be very complicated.

The "type" in the Module Access Policy (MAP) you mentioned is to determine whether the script can perform an encryption or decryption. You would need to determine elsewhere whether the script is called.

The closest solution I can think of would be storing the value within the custom field, but having some sort of modal/popup where a user inputs/reads the encrypted value. This modal would call a server side script to determine access, and then call a script with explicit access via a MAP, to decrypt or encrypt the value.

[israyalkhan1]

Hi @Kieran Anson,

How can we satisfy this requirement by script only to decrypt the value for current assigned_to and caller_id user can see field in incident form

[Kieran Anson]

What have you tried so far, based on my suggestion?

[israyalkhan1]

Hi  @Kieran Anson , In my PDI I have tried, like you mentioned that have any modal/popup so I have created a UI action button and written a script include to decrypt the value and by UI action calling that script include. It is working and field value is showing as popup in incident form.
But this is not my requirement and we cannot create any ui action and based on you suggested solution it is only show decrypted value of field but field is not visible in form.

so if by any other script or other method to do this so field can also should be visible in form.