When creating new application files in a scoped application, cross scope access is turned on...

"By default, all application scope scripts can read the table's records but cannot perform any other database operations." https://developer.servicenow.com/dev.do#!/learn/learning-plans/tokyo/servicenow_administrator/app_store_learnv2_securingapps_tokyo_application_access_database_settings