Access Control Lists (ACLs) are an effective way to provide security for an application. They can be customized to restrict users from reading, writing, creating, or deleting certain records and fields. For example, you can use an ACL to ensure only users with the role of an admin can delete records.
When creating an ACL, you will need to include permissions. Permissions are requirements that the user has to pass in order to gain access to the record or field.
There are three permissions on an ACL:
- Requires role
- Condition
- Script
We will cover all three permissions in this post.
Requires role
The specified roles determine which users can perform a particular action on a record or field. If for example, you wanted only admins and managers to be able to read the records, you would include both the admin and manager roles in the Requires role field. If a user with the role of an employee tries to view those records, the ACL will not pass the check and will prevent access. If the user passes the Requires role check, they move on to the next check.
Condition
The conditions determine which of the records the user can see. As you change the conditions, the blue message will update to tell you how many records match the condition you created. If we wanted to make an ACL that lets an employee only see their records, we would have the Requires role set to employee and then a condition that says [User] [is (dynamic)] [Me]. First, the ACL makes sure that the user is an employee, then it goes through the records in the table and lets the user view the ones where they are the user. The user can only read the records if they get permission from both the Requires role and Condition checks.
Script
The script field is only shown when Advanced is selected from the top of the form. Once Advanced is selected, the following field appears:
The script is the third and final check to give permission to the user. There must be some condition that sets the answer variable to true or false inside of the script logic. The script is used to gather more specific information, such as the sys_id of the user, or whether or not the user is logged in. A list of other GlideSystem methods can be found here. The ACL grants access to the records if the Required roles, Condition, and Script all evaluate to true.
Once all the permissions are established, you can check your ACL by assigning desired roles to users and impersonating them on your developer instance. More information can be found in the training modules for Creating and Editing Access Controls.
