Table record restriction

overview while docid\ dgbxcjvfb7y3eykgb ixz is used to define which table(s) and field(s) users can see and/or edit, this capability is used restrict visibility to subset of records within a table for example, if a subset of users is only allowed to view incidents that they raised or raised for them, the following need to be configured a role (or can use an existing role if it fits your broader security model) permission(s) to allow read access to the incident table for the role in step 1 above table record restriction to restrict access to incidents raised by or raised for currently logged on user, if the user has the role in step 1 above role assignment to the user(s) that need to get such restriction (can be done via group membership too) how it works whenever a query is performed on a table, and this includes viewing a record directly via a link, the platform checks if there is any table record restriction defined for the table if there is, the query script defined in a table record restriction will run this script may return an extra table query if there is an extra table query returned for the user, it will be added to whatever query a user use for the table example a user is querying for open incidents there is a table record restriction for incident configured, and it is active the table record restriction's query script checks if the currently logged on user has a particular role if the user has it, the script is to return an extra table query of incidents with requestor or requested for, being the currently logged on user if the user has that role mentioned above in step 3, then the query in step 1 above will return open incidents, but only ones with requestor or requested for, as themselves configuration for table record restriction configuration, the below needs to be filled in field name description example name name of the table record restriction, give it a meaningful name incident record visibility restrictions description what the table record restriction does, be descriptive the restrictions for incident records for non agent users active if activated, the table record restriction will always run for every query on the specified table yes table which table the table record restriction runs on incident query the restrictions to apply on the table you can add different kind of restrictions based the user's information such as role(s) and group memberships the script has to set answer variable if answer answer is not set, then no extra query is added (no extra restrictions added) example code below example query //if the user is able to read the table, but does not have the agent role, they can only see incidents that they are requestor or requested for if (!user hasrole("itsm agent")) { answer = or( equal("requestor", user getid()), equal("requestedfor", user getid()) ); }