prevent user accounts who may have itil or any other role that could access the sys_attachment table from utilizing "apis" to access those attachments

 /* SW • Added 01/12/2021
    ** This was added to check for any non-interactive users (service accounts used for integrations)
    ** to ensure they only have access to attachments in which the record it is attached to is the
    ** same company as the service account.
    */
    
    // Remove Prefix
    var tableName = current.table_name;
    if (tableName.startsWith("invisible."))
        tableName = tableName.substring(10);
    else if (tableName.startsWith("ZZ_YY"))
        tableName = tableName.substring(5);

    var parentRecord = new GlideRecord(tableName);
    parentRecord.setWorkflow(false);
    parentRecord.get(current.table_sys_id)

    if (!gs.getSession().isInteractive())
        return verifyReadAccessFromNonInteractiveUsers(parentRecord);

    function verifyReadAccessFromNonInteractiveUsers(parentRecord) {
      if ((gs.hasRole("snc_platform_rest_api_access")) && (parentRecord.canRead()) && (parentRecord.company == gs.getUser().getCompanyID()))
        return true;
      return false;
    }