In ServiceNow,Table Access Control (ACL) rulesdefine the permissions for accessing records within a table. When a user attempts to access a record, ServiceNow processesACL rules in a specific orderto determine if the user has the necessary permissions.
Specific Table Name ACLs
ServiceNowfirst checks ACL rulesthat are defined for the exact table being accessed.
If there are multiple ACL rules for the same table, ServiceNow evaluates themfrom most specific to least specific(i.e., field-level ACLs before table-level ACLs).
Parent Table Name ACLs(If applicable)
If the table inherits from another table (e.g.,Incident inherits from Task), ServiceNownext checks ACL ruleson theparent table.
This ensures that inherited rules are properly applied.
Wildcard ACLs (*)(Any table)
If no explicit ACL rule is found for the table or its parent, ServiceNow checkswildcard ACL rules (*), which apply toall tables.
Wildcard ACLs act as alast resortwhen no table-specific rules exist.
Order of Processing ACL Rules:
(A) any table name (wildcard), parent table name, table name – Incorrect
Wildcard rules (*) areprocessed last, not first.
(B) table name, parent table name, any table name (wildcard) – Correct
This follows the correctprocessing order:
First:ACLs for the specific table
Second:ACLs for the parent table (if applicable)
Third:Wildcard ACLs (*)
(C) parent table name, table name, any table name (wildcard) – Incorrect
Parent table ACLs arechecked aftertable-specific ACLs, not before.
(D) any table name (wildcard), table name, parent table name – Incorrect
Wildcard ACLs (*) arealways processed last, so this order is incorrect.
Explanation of Each Option:
Field-level ACLs(column-specific) take precedence overtable-level ACLs.
If multiple ACL rules apply,all must evaluate totruefor access to be granted.
Explicit Deny:If an ACL rule explicitlydenies access, the user is denied, even if another ACL grants access.
Always Test ACLs:Use the "Security Debugging" feature (/sys_security_acl_list.do) to verify how ACLs are applied.
Additional Notes & Best Practices:
ServiceNow Docs: How Access Control Rules Work
https://docs.servicenow.com
ServiceNow Community: Understanding ACL Processing Order
https://community.servicenow.com
References from Certified System Administrator (CSA) Documentation:
