A user holding the itil role opens an incident record and every field renders except a custom field named u_cost_centre, which is absent from the form, absent from the incident list view and empty in a CSV export of the same records. The read access control rule on the incident table itself evaluates to true for this user. What explains the behaviour?
- AA field level read access control rule on incident.u_cost_centre requires a role the user does not hold, and both the table rule and the field rule must pass before the value is returned. Correct
- BA UI policy on the Incident form hides u_cost_centre for users without a finance role, so the field is suppressed on the form and in every other view of the data.
- CA before query business rule on the incident table adds a condition that strips u_cost_centre from the result set returned to users without a finance role.
- DThe dictionary entry for u_cost_centre is configured as read only for the itil role, so the stored value stays hidden until the user is granted write access to the field.
Why A is correct: Correct: table level and field level read rules are both evaluated, so passing the table rule still leaves the field rule able to deny the single field wherever the data is requested.
Why B is wrong: Tempting because a UI policy is a common way to hide a field and does render it invisible on the form, but a UI policy acts only on the form at runtime and cannot remove a field from a list view or from an export.
Why C is wrong: Tempting because a before query business rule really does filter what a user gets back, but it filters whole records rather than individual fields, so it would hide incidents, not one column of a visible incident.
Why D is wrong: Tempting because a read only dictionary setting does restrict what a user may do with a field, but read only still displays the value; it blocks editing rather than reading.