Hi Amit,
"..Can you check, if personal views are shared with user or not ? if yes then you can just remove the permission from it so that it will be not visible to them..."
""..Also In general "Service Reader" is just a role which have Read permission on all the entities..."
When this role is applied to a profile it can see even views that are not shared with them, plus as you said reading access to a big number of other identities in Organization level independently of the BU of the user, bad!
"As a suggestion you can create a new role where just add below article's permissions for the email templates and add read permission for the case that is it. Try this new role and test it once.""
Basically is what I have been doing this morning, trying to remove the role from one of the users and try to tweak our own generic one accordingly, one problem was that removing the "Service Reader" role lost reading access to email templates, they were not showing in case form timeline email actions, now sorted as well
This new role is more appropriated and less intrusive than "Service Reader", surely will need some tweaking and testing but is looking promising so far
--
My only question left, and this is for learning and being a stubborn being, is what specific feature of the "Reader Role" gives access to all the views independently of shared of not, in my opinion no a role that should be given to a generic user, I thought will be Core Records Tab / Saved View but none access is selected, then had a look to customization tab view, which is selected to Read Acccess / Organization Level, however does not look like is any of those or might be intrinsic within the security role itself, honestly don't know
Thanks to everyone that contributed specially @Amit Katariya007 and Nya
