Articles, Blogs, Videos, Podcasts, Share projects - Experiences from the field

 

Hi there,

 

Imagine working as an HR Service Desk employee, handling HR Cases on a daily basis. As part of your job, you have access to the Work Notes field. Nothing unusual there. But what if you are the Subject Person of an HR Case yourself?

 

Perhaps the HR Case is about your sick leave, salary, performance review, or another sensitive matter. Should you still be able to read the internal Work Notes on that particular HR Case?

 

At a customer, we came across exactly this scenario and decided to look into it.

 

Out-of-the-box behavior

Out-of-the-box, ServiceNow provides a Read ACL on "sn_hr_core_case.work_notes". Users with the "sn_hr_core.case_reader" role can read Work Notes, provided the configured Security Attribute conditions are satisfied.

 

However, there is no explicit check to prevent an HR Agent from reading Work Notes when they are the Subject Person of the HR Case themselves.

 

 

Introducing a Deny Unless ACL

Rather than modifying the out-of-the-box ACL, we introduced an additional Read ACL using the Deny Unless decision type. We kept the existing role and Security Attribute conditions, and added one Condition:

Subject Person | is not | javascript:gs.getUserID()

 

 

The important part here is the Deny Unless decision type. Unlike an Allow If ACL, a Deny Unless ACL can prevent access even when another ACL would otherwise allow it. With this additional ACL, an HR Agent who is also the Subject Person of an HR Case will no longer be able to read the Work Notes through this field ACL, assuming no applicable override.

 

Food for thought

I'm not saying everyone should implement this customization, or even use this exact approach. Every organization has its own HR processes and security requirements. However, it's an interesting scenario to consider. Just because someone is an HR Agent, should they automatically be able to read internal Work Notes about themselves?

 

Something worth checking in your own HRSD implementation!

---

 

That's it. Hope you like it. If any questions or remarks, let me know!

 

| C |

If this content helped you, I would appreciate it if you hit bookmark  or mark it as helpful.

 

Interested in more Articles, Blogs, Videos, Podcasts, Share projects I shared/participated in?

- Articles, Blogs, Videos, Podcasts, Share projects - Experiences from the field

|

 

Kind regards,

Mark Roethof

Independent ServiceNow Consultant

11x ServiceNow MVP

---

LinkedIn