Some PDIs are currently unavailable, and PDI actions are paused. View the latest updates here. Read More

Needs to show caller_id=current.loginuser && Mangers reports caller_id incidents needs to show

chaitanya2948
Tera Contributor

an hour ago

Hi Team,

I have a requirement for the Incident table regarding Read and Write access based on the caller's management hierarchy.

Requirement

Access should be granted according to the following rules:

  1. The caller of the incident should be able to read and update their own incident.

    • Condition: Caller = Current Logged-in User

  2. Any manager in the caller's management hierarchy should be able to read and update the incident.

    • This includes the caller's direct manager, manager's manager, and so on up to the top of the organization.

  3. Subordinates should not have access to their managers' incidents.

    • Employees should only be able to access their own incidents and should not be able to view or update incidents created by their managers or higher-level managers.

Example Hierarchy

CEO
  │
Manager 4
  │
Manager 3
  │
Manager 2
  │
Manager 1
  │
Employee 1

Expected Behavior

Logged-in User Incident Caller Access

Could you please confirm the recommended approach for implementing this requirement in ServiceNow, particularly whether it should be handled using ACLs and any scripts will helps 

 

Regards,

CK.

0 Helpfuls
  • 95 Views
1 REPLY 1

Nilesh Pol
Kilo Sage

an hour ago - last edited an hour ago

@chaitanya2948 

You can achieve the requirement using ACLs (Access Control Lists) are the recommended and standard ServiceNow approach for this requirement because the access decision is based on the current user and the specific Incident record being accessed.
I will suggest you to create two Record ACLs on the Incident [incident] table:
First, Read ACL: Operation: read, Table: incident, Scripted ACL and 
Secord, Write ACL: Operation: write, Table: incident, Scripted ACL.
 

The ACL script should return true when:

Logged-in user is the Caller.
Logged-in user is the Caller's manager.
Logged-in user is the manager's manager.
Continue checking upward until the top of the hierarchy.

If none of these conditions are met, return false.

 

Instead of duplicating the logic in multiple ACLs, create a Script Include (Best Practice):
then call it into ACL script like:
answer = new HierarchyAccessUtil().isCallerOrManager(current.caller_id.toString(), gs.getUserID());
 
Will suggest you try at your end first for code of script include or let us you need all?
0 Helpfuls