File access permissions
Summarize
Summary of File Access Permissions
Workspace administrators with thesngrcworkspace.adminrole manage file access permissions for users and groups in ServiceNow. These permissions govern how users interact with files linked to Governance, Risk, and Compliance (GRC) records, ensuring secure and appropriate access based on defined configurations.
Show less
Key Features
- Unique Permission Records: Only one file access permission record can exist for each unique combination of Table, Access permission, and Users to prevent duplicates. Similarly, only one active Cloud file configuration is allowed per Table and Provider combination.
- Access Levels: Users belonging to multiple groups or user fields receive the highest access level assigned among those groups.
- Source Link vs Reference Link: When a cloud file is connected to a GRC record for the first time, it is a source link with write access. Subsequent mappings to other GRC records create reference links with read-only access.
- Permission Enforcement: Access permissions configured for source links are applied exactly. For reference links, users receive read access regardless of configured write permissions.
- Dynamic Source Link Management: If a source link mapping is removed, the next mapped GRC record becomes the new source link, maintaining proper access control.
- Request Access and Refresh Actions: On engagement and audit task records, file access permissions are enabled by default. For other records, users in groups can use the Request access action to request file access, and users configured in cloud file settings can use Refresh file access to update their permissions.
Practical Application for ServiceNow Customers
ServiceNow customers can leverage these configurations to:
- Define precise and non-overlapping file access permissions based on roles, groups, and record types.
- Ensure secure collaboration by automatically granting higher access when users belong to multiple groups.
- Manage access to cloud files effectively by distinguishing between source and reference links to GRC records.
- Streamline user access requests with built-in UI actions, reducing administrative overhead.
- Maintain accurate access controls dynamically as records and file mappings change.
Additional Notes
- Request access is a one-time action per user group; repeated requests display informative messages.
- If access requests are not processed timely, users must use the Refresh action to retry.
- For configuring file access permissions on additional tables beyond engagement and audit task records, refer to the detailed configuration guidance in the relevant knowledge base article (KB1587297).
The Workspace administrators with the sn_grc_workspace.admin role can configure the file access permissions for the users and groups.
Conditions for file access permissions
The Workspace administrators with the sn_grc_workspace.admin role can configure different conditions for file access permissions:
- For a combination of the Table field, Access permission field, and Users field, you can have only one File access permission record. If you have an existing record for a table with a given set of user and access permissions, you cannot create a duplicate record with the same access permissions. For example, if a contributor has Read access permission for the policy (sn_compliance_policy) record, creating another record for the same condition is not permitted.
For a given combination of the Table field, Provider field, and Active option, only one Cloud file configuration record is permitted. A duplicate configuration is not permitted for an active table as shown in the following example.
- If a user is part of multiple User fields or a Group field, a higher access is granted to the user.
Source link and reference link to the GRC record
When a cloud file is connected to a GRC record for the first time, the connection is considered as a source link to the GRC record.
When the same cloud file is mapped to another GRC record, then it is considered as a reference link to the GRC record.
A source link to the GRC record always has the write access and the reference link to the GRC record always has the read access.
When a record is mapped as a source link to the cloud file, the configuration is applied as it is to the cloud file. For example, if the configuration contains write access for some users and read access for some users, the same configuration is maintained and applied to the users.
The Document reference table shows how one document record is being referenced such as its source link and reference link to the GRC record as shown in the following example
Consider the example of Engagement_memo.xslx for which Control test CTR0020005 is a source link and Control test CTR0020004 is a reference link. For any configuration that matches the configuration of Control test CTR0020004, all the users under this configuration even though they have Write access in the configuration has only read access.
| Document | Record that the document is connected to |
|---|---|
| Risk and Controls Matrix Report | Engagement record 1. It is the source for the access document. |
| Risk and Controls Matrix Report | Engagement record 2. It is the reference for the access document. |
| Access doc connected to the record | Users field value | Type of access | Description |
|---|---|---|---|
| Engagement record 1 | Contributors | Have Write access | For the source record, the permission configuration is considered as it is configured. Therefore, the contributors have the Write access to Engagement 1. |
| Engagement record 2 | Reviewers | Have Write access | The same access record is mapped to Engagement 2, for which the reviewers should have the Write access. Because Engagement record 2 is a reference record, the reviewers have the Read access instead of the Write access. |
Another use case for source link
When the cloud document is mapped to a record, it becomes a source link for the cloud document. If the same record is removed and the cloud document is mapped to another GRC record, the next record becomes the source link for the cloud document.
For example, the Engagement_memo.xlsx file is mapped to the engagement 1 and engagement 2 records. The engagement 1 record is the source link and the engagement 2 record is the reference link. If the mapping between the Engagement_memo.xlsx file and the engagement 1 record is removed, the Engagement_memo.xlsx file does not have any source link. If the Engagement_memo.xlsx file is mapped to the engagement 3 record, then the engagement 3 record becomes the source link for the document.
Request access and Refresh file access actions
By default, the file access permissions are enabled on the engagement and audit task records. For other records, you can use the Request access and Refresh file access actions on the form. By default, the file access permissions are enabled on the engagement and audit task records. If a user is part of a group, they can use the Request access UI action to request access to the file. The Request access UI action is available only to the group members. If the user is part of a cloud file configuration, they can use the Refresh file access action to refresh or configure the file access. The Refresh file access action is available to the users mentioned in the cloud file configuration.
To configure the file access permissions on other tables such as control records or policy records (instead of using the manual Request access and Refresh file access actions), see the configuration steps in KB1587297.
The users that are part of a group should request access to the cloud file by using the Request access action button. When a user who is part of the Audit Managers group selects Request access on the form, a UI message is displayed as shown in the example: The file access is being processed.
Requesting access to the cloud file is a one-time activity for the users of a group. If a user selects Request access more than once and the access has already been granted, the following message is displayed: File access has already been granted.
If the user requests access to the cloud file and if the request is not processed in time, an error message is displayed on the screen. The user must select Refresh file access to request an access to the file again.