(What is the order of evaluation for elements in Access Control Lists?

ServiceNow ACLs (Access Control Lists) determine whether a user can perform an operation (read, write, create, delete, etc.) on a table, record, or field. When an ACL includes multiple types of checks, the platform evaluates them in a defined sequence. ServiceNow documentation describes permission evaluation using rule types and indicates that Role checks are evaluated first, followed by additional rule criteria such as conditions, and finally scripts when present. This order matters for both security and performance. Role evaluation is typically fastest and can short-circuit further checks. If the user does not meet the role requirement, the platform does not need to evaluate the condition or run a script. Conditions are then evaluated to confirm record-based or context-based requirements. If the ACL still requires deeper logic beyond roles and conditions, a script can be executed last to decide access (often setting an answer value or returning true/false depending on the ACL type). Therefore, among the provided choices, the correct sequence is Roles → Conditions → Script.