Needs to show caller_id=current.loginuser && Mangers reports caller_id incidents needs to show

[chaitanya2948]

Hi Team,

I have a requirement for the Incident table regarding Read and Write access based on the caller's management hierarchy.

Requirement

Access should be granted according to the following rules:

1. The caller of the incident should be able to read and update their own incident.

   • Condition: Caller = Current Logged-in User

2. Any manager in the caller's management hierarchy should be able to read and update the incident.

   • This includes the caller's direct manager, manager's manager, and so on up to the top of the organization.

3. Subordinates should not have access to their managers' incidents.

   • Employees should only be able to access their own incidents and should not be able to view or update incidents created by their managers or higher-level managers.

Example Hierarchy

CEO
  │
Manager 4
  │
Manager 3
  │
Manager 2
  │
Manager 1
  │
Employee 1

Expected Behavior

Logged-in User Incident Caller Access

Could you please confirm the recommended approach for implementing this requirement in ServiceNow, particularly whether it should be handled using ACLs and any scripts will helps 

Regards,

CK.

[Nilesh Pol]

@chaitanya2948 

You can achieve the requirement using ACLs (Access Control Lists) are the recommended and standard ServiceNow approach for this requirement because the access decision is based on the current user and the specific Incident record being accessed.

I will suggest you to create two Record ACLs on the Incident [incident] table:

First, Read ACL: Operation: read, Table: incident, Scripted ACL and 

Secord, Write ACL: Operation: write, Table: incident, Scripted ACL.

The ACL script should return true when:

Logged-in user is the Caller.
Logged-in user is the Caller's manager.
Logged-in user is the manager's manager.
Continue checking upward until the top of the hierarchy.

If none of these conditions are met, return false.

Instead of duplicating the logic in multiple ACLs, create a Script Include (Best Practice):

then call it into ACL script like:

answer = new HierarchyAccessUtil().isCallerOrManager(current.caller_id.toString(), gs.getUserID());

Will suggest you try at your end first for code of script include or let us you need all?

[Tanushree Maiti]

Hi @chaitanya2948 

You can try with Create/update Read and Write ACL along with following script

• Navigate to System Security > Access Control (ACL)
• Create or modify a table-level ACL with:
• Type: record
• Operation: read (and a separate one for write)
• Name: incident

answer = false;

var loggedInUser = gs.getUserID();

var callerId = current.caller_id.toString();

if (callerId === loggedInUser) {

    answer = true;

} else {

   var callerGr = new GlideRecord('sys_user');

    if (callerGr.get(callerId)) {

        answer = isMgrInHierarchy(callerGr, loggedInUser);

    }

}

function isMgrInHierarchy(callerGr, userSysId) {

    if (!callerGr || !callerGr.manager) 

return false;

    var currentManager = callerGr.manager.toString();

    if (currentManager === userSysId) {

        return true;

    }

    var mgrGr = new GlideRecord('sys_user');

    if (mgrGr.get(currentManager)) {

        return isManagerInHierarchy(mgrGr, userSysId);

    }

    return false;

}