Skip to tutorial content
Rate module Not yet rated

How ACLs Work

3 min read
On this page

In this lesson, you will learn:

  • What an ACL is
  • The operations an ACL protects
  • The three checks every ACL makes

1 Who can see and change what?

Riya should see her own incidents, but not the HR cases of other people. Agents can edit incidents, but only admins can delete them. These rules are enforced by access control lists, or ACLs. 🔐

Key term: ACL (access control)

A security rule that decides if a user can do an operation (like read or write) on a table or field. Stored in sys_security_acl. Find them in System Security > Access Control (ACL).

2 Operations

Operation Controls whether the user can…
read See records or fields
write Change existing records or fields
create Insert new records
delete Delete records

There are other operations too, like execute (for running things such as client-callable script includes), but these four are the ones you’ll use most.

3 Three checks

An ACL makes three checks, and the user must pass all of them. Check 1, Roles: does the user have one of the required roles, like itil? Check 2, Condition: does the record match the condition, like Active is true? Check 3, Script: does the script return true, for example answer equals true when the caller is the current user? Pass all three, and access is allowed. Fail any one, and this ACL doesn't grant access.
Figure 1. Roles AND Condition AND Script. All three must pass.
  • Roles: the user needs at least one of the listed roles. Empty means no role is needed.
  • Condition: the record must match. Empty means any record.
  • Script: must set answer to true (Advanced checkbox). Empty means it passes.

📝 Note: To create or change ACLs, you need the security_admin role, and you must elevate to it first (Lesson 42.4).

💡 Good to know: Newer releases also have a Decision type on ACLs: Allow If (the normal kind) and Deny Unless. Deny-Unless ACLs are checked first and can block access, but only Allow-If ACLs actually grant it.

⚠️ Heads up: If no ACL grants access, the answer is no. ServiceNow denies by default. Test every change by impersonating a normal user.

⭐ Remember: ACL = operation + object. To pass: role AND condition AND script.

4 Let’s try it: read an ACL

  1. From your user menu, choose Elevate role, check security_admin, and click Update.
  2. Open System Security > Access Control (ACL). Filter Name is incident, Operation is write.
  3. Open one. What roles does it need? Is there a condition or a script?

5 Quick recap

  • ACLs control access to tables and fields
  • Main operations: read, write, create, delete
  • Three checks: roles, condition, script. All must pass
  • No ACL grants access? Then access is denied
  • Elevate to security_admin to change ACLs

6 Check yourself

Think of your answer first. Then tap to check.

1 An ACL needs the itil role and has a condition “Active is true”. The user has itil, but the record is inactive. Does this ACL grant access? Show answer

No. All three checks must pass, and the condition fails.

2 Which operation controls whether a user can see a field? Show answer

read.

3 Which role do you need to edit ACLs? Show answer

security_admin (elevated).

Nice work! You finished this lesson. 🎉

Was this lesson helpful?

Have a question or doubt?

Ask here and get help from instructors and fellow learners.

0 / 300

Only logged-in learners can post.