We are often told to avoid sharing business data across service boundaries. However, I tend to see the need for a service to access data from a different service.
An example of this would be IT functions needing to access employee position and corporate structure (i.e. the managerial ladder) - this information is typically maintained by HR. Specifically if there is an IT policy that only directors and above are eligible to request certain IT devices if they do not have ones already from the company. In order to enforce this rule, the IT service will need to access HR data as part of its business logic to accept/reject such requests.
The SOA guideline is also not to couple services via request-response communication purely to ask for data.
If data sharing is discouraged across service boundaries, how could other services enforce their dependent business rules on data from another service? For example the request of an IT device cannot be initiated from the HR service.
What is your advice?