The "ngbsm_view", which is not domain separated, can show Users and CIs references from different domains<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Issue: In a domain-separated instance, users from one domain can see Dependency Map views (ngbsm_view) created by users in another domain. The ngbsm_view table itself is not domain-separated, but it references domain-separated tables: User and Configuration Item (CI). As a result, users were able to see the display names of these records in UI16, even if they did not have access to the underlying records.Steps to Reproduce:1) Find or create a domain-separated instances, such that domains "A" and "B" are siblings of each other (AKA both children of top level)2) Impersonate a user in domain 'A'3) Load the Dependency Map and search for a CI within domain 'A'4) Change filters and save as a view from the upper left menu5) Impersonate a user in domain 'B'6) Navigate to "ngbsm_view" list view7) Note that the view created in Step 4 is visible, as is the display value of the User and CIResolution:A PRB has been created (PRB1960563) to implement an out-of-the-box solution.The PRB confirms that a "User is 'Me'" condition can be added to the READ ACL for the ngbsm_view table.This ensures that users can only see their own views in the list.Load/Save View functionality in the Dependency Map continues to work correctly.Once implemented, the UI16 list view will be restricted to records specific to the current user, resolving the cross-domain visibility issue.