RCA Errors in HR scoped application after upgradingDescriptionDuring an upgrade, the "Caller Access" value of non-customized Script includes in the HR scoped applications that were set to None may be switched to Restricted as a result of out-of-box updates. This can result in Restricted Caller Access (RCA) errors in certain HR functionality. For example, when submitting requests from the Employee Service Center (ESC) or HR service portal. Errors similar to these might be seen: Execute operation on script include 'hr_ServicesUtil' from scope 'Global' was denied because the source could not be found. Please contact the application adminExecute operation on script include 'hr_ServicesUtil' from scope 'Global' was denied. The application 'Global' must declare a cross scope access privilege. Please contact the application admin to update their access requests. This affects older Script Includes that existed prior to the Kingston release, which was initially set to "Caller Access" None on the first post-Jakarta upgrade for backward compatibility (The "Caller Access" field was added in Jakarta). During additional upgrades, any of those Script Includes that receive out-of-box changes from development features or defects can result in having the "Caller Access" being changed to Restricted.This can cause functional issues if there any customizations that reference any of those Script Includes if they don't have any related Restricted Caller Access (sys_restricted_caller_access) record with "Status" set to Allowed and "Source Scope" set to the calling scope. This could affect any of the following Script Includes: HR Core HR SP HR LEhr_CaseHierarchyUtilshr_AssignmentAPIhr_AssignmentUtilhr_CaseUtilshr_licensehr_SysUserGeneralHRFormhr_TemplateOwnershiphr_BulkCaseUploadhr_PdfUtilshr_Taskhr_CaseHRCoeHRBenefitTableshr_Profilehr_Login_Authenticatorhr_TemplateUtilshr_ServicesUtilhr_Criteriahr_MySubjectStatshr_CoreUtilshr_PortalContentemailUtilhr_PortalUtilhr_TaskTicket DTUtilhr_LETypehr_ActivitySethr_ActivitySetTriggerhr_ActivityUtilshr_le_coe_config Steps to Reproduce Upgrade to London or later release with HR scoped applications installed.Notice any issues after upgrade (e.g. RCA errors submitting cases on HR Service Center / Employee Service Center, RCA errors in log).Go to module System Applications > Application Restricted Caller Access and search for a record with "Target" referring to one of the previously-mentioned Script Includes and "State" NOT Allowed.See that there are records in Requested state, with "Target" referring to one of the previously-mentioned script includes OR there are NO records with "Target" referring to one of the previously-mentioned Script Includes and "Source Scope" set to the scope the mentioned in the RCA errors.WorkaroundDo one of the following: Allow access for any new privilege file(s) that were generated: Go to module System Applications > Application Restricted Caller AccessSet filter to "Status Is Requested"Set the Status to "Allowed" for any records that are "Requested" and have "Target" set to the specific script include that is not working. If there isn't any existing RCA record with "Target" set to the specific script include that is not working and "Source scope" set to the scope where the Script Include is being called form, create a new RCA record for it. 3. OR Reset the Script Include that is causing errors to "Caller Access" = "None" (disables RCA). Note: This may make it harder to get out-of-box updates For example, if the error messages you are getting are: Execute operation on script include 'hr_ServicesUtil' from scope 'Global' was denied because the source could not be found. Please contact the application adminExecute operation on script include 'hr_ServicesUtil' from scope 'Global' was denied. The application 'Global' must declare a cross scope access privilege. Please contact the application admin to update their access requests. Check whether there is any RCA record with "Target" = script include "hr_ServicesUtil" and "Source Scope" = "Global": /sys_restricted_caller_access_list.do?sysparm_query=target%3De0d7bdf79f031200d9011977677fcf15%5Esource_scope%3Dglobal If any such record exists, check their "Status" and make sure it is set to "Allowed". If no such record exists, move to the Human Resources:Core scope and create a new RCA record with: Source Scope: GlobalSource Type: ScopeStatus: AllowedTarget Scope: Human Resources: CoreTarget Type: Script IncludeTarget Table: Script Include [sys_script_include]Target: hr_ServicesUtilOperation: Execute API More information can also be found on the documentation: HR Service Delivery upgrade information Related Problem: PRB1357095