[{"data":1,"prerenderedAt":390},["ShallowReactive",2],{"page-\u002Fblog\u002Fservicenow-acl-troubleshooting-guide":3},{"id":4,"title":5,"author":6,"authorUrl":7,"body":8,"date":365,"dateUpdated":365,"description":366,"dqid":365,"excerpt":367,"extension":368,"faq":369,"headline":382,"meta":383,"navigation":384,"path":385,"seo":386,"socialImage":387,"stem":388,"__hash__":389},"content\u002Fblog\u002Fservicenow-acl-troubleshooting-guide.md","ServiceNow ACL Troubleshooting: A Practical Access Control Guide","SN-Tricks","https:\u002F\u002Fsn-tricks.com\u002Fabout",{"type":9,"value":10,"toc":348},"minimark",[11,15,18,23,42,60,71,74,78,81,84,101,104,108,111,114,117,121,128,131,134,149,152,156,159,163,166,170,173,177,184,207,210,214,227,230,250,253,257,260,263,277,280,284,287,304,307,311,314,331,334,338,341,344],[12,13,14],"p",{},"ServiceNow access problems often look simple: a user cannot open a record, a field disappears, or an update is rejected. The tempting fix is to add a role or loosen an access control list (ACL). That may remove the symptom, but it can also expose data far beyond the original use case.",[12,16,17],{},"A safer approach is to identify the exact ACL decision, prove why it failed, and make the smallest change that satisfies the business requirement. This guide provides a repeatable process for troubleshooting ServiceNow ACLs while preserving least-privilege access.",[19,20,22],"h2",{"id":21},"understand-what-servicenow-is-evaluating","Understand What ServiceNow Is Evaluating",[12,24,25,26,30,31,30,34,37,38,41],{},"An ACL controls an operation such as ",[27,28,29],"strong",{},"create",", ",[27,32,33],{},"read",[27,35,36],{},"write",", or ",[27,39,40],{},"delete"," on a table or field. A rule can evaluate:",[43,44,45,49,52],"ul",{},[46,47,48],"li",{},"Required roles",[46,50,51],{},"A condition built from record fields",[46,53,54,55,59],{},"A script that sets ",[56,57,58],"code",{},"answer"," to true or false",[12,61,62,63,66,67,70],{},"For a field operation, passing a table-level ACL is not enough. The user must also pass the applicable field-level ACL. ServiceNow also evaluates rules across the table hierarchy and can match rules with wildcards, such as ",[56,64,65],{},"table.*"," or ",[56,68,69],{},"*.field",".",[12,72,73],{},"This is why looking at only one ACL record can be misleading. The effective decision may involve rules defined on a parent table, a wildcard rule, and a field-specific rule.",[19,75,77],{"id":76},"_1-reproduce-the-exact-failure","1. Reproduce the Exact Failure",[12,79,80],{},"Start by documenting the real scenario rather than testing a simplified version.",[12,82,83],{},"Capture:",[43,85,86,89,92,95,98],{},[46,87,88],{},"The affected user and their roles",[46,90,91],{},"The target table, record, and field",[46,93,94],{},"The attempted operation: read, write, create, or delete",[46,96,97],{},"The interface used: form, list, Workspace, portal, API, or mobile",[46,99,100],{},"Whether all records fail or only records with certain values",[12,102,103],{},"Confirm that the issue is actually security-related. A UI policy, client script, dictionary attribute, data policy, or Workspace configuration can also make a field read-only or hidden. If a user can update the field through an API but not through the form, investigate the interface layer before changing ACLs.",[19,105,107],{"id":106},"_2-test-as-a-representative-non-admin-user","2. Test as a Representative Non-Admin User",[12,109,110],{},"Do not use an administrator account as your primary test. Admin behavior can differ from normal user behavior, and broad roles may hide the missing permission.",[12,112,113],{},"In a sub-production instance, impersonate a user with the same groups, roles, domain, and record relationships as the affected user. If impersonation itself changes the behavior of an integration or authentication feature, create a dedicated test user instead.",[12,115,116],{},"Compare the failing user with a user who has the expected access. Role differences are useful evidence, but do not immediately copy every role from the working user. A role may grant access to unrelated applications and data.",[19,118,120],{"id":119},"_3-use-debug-security-rules","3. Use Debug Security Rules",[12,122,123,124,127],{},"Enable ",[27,125,126],{},"Debug Security Rules"," from the debugging modules, then reproduce one specific failed action. The debug output shows ACL evaluations and whether each rule passed or failed.",[12,129,130],{},"Keep the test narrow. Loading a complex form or large list can generate extensive output because security is checked for many fields and related records. Focus on the target table, field, and operation.",[12,132,133],{},"When reviewing the results, ask:",[135,136,137,140,143,146],"ol",{},[46,138,139],{},"Which ACL produced the decisive failure?",[46,141,142],{},"Was it defined on the target table, a parent table, or a wildcard?",[46,144,145],{},"Did the role check, condition, or script fail?",[46,147,148],{},"Is a field ACL failing after the record ACL passes?",[12,150,151],{},"Disable debugging after the test. Security debug output is noisy and should not remain active during normal administration.",[19,153,155],{"id":154},"_4-inspect-roles-conditions-and-scripts-separately","4. Inspect Roles, Conditions, and Scripts Separately",[12,157,158],{},"An ACL with multiple requirements succeeds only when its configured checks succeed. Evaluate each part independently.",[160,161,48],"h3",{"id":162},"required-roles",[12,164,165],{},"Verify that the user actually receives the role, including inherited roles. Check whether the role is intended for that persona. Avoid assigning a powerful fulfiller or application-admin role merely to satisfy one field requirement.",[160,167,169],{"id":168},"conditions","Conditions",[12,171,172],{},"Inspect the record values used by the condition. Pay attention to empty references, inactive users, state values, and whether the rule is being evaluated during record creation before all fields are populated.",[160,174,176],{"id":175},"scripts","Scripts",[12,178,179,180,183],{},"Read the script for assumptions about ",[56,181,182],{},"current",", references, groups, or session state. A secure script should set a clear boolean result and safely handle missing values.",[185,186,191],"pre",{"className":187,"code":188,"language":189,"meta":190,"style":190},"language-javascript shiki shiki-themes github-dark","answer = current.isValidRecord() &&\n    current.caller_id == gs.getUserID();\n","javascript","",[56,192,193,201],{"__ignoreMap":190},[194,195,198],"span",{"class":196,"line":197},"line",1,[194,199,200],{},"answer = current.isValidRecord() &&\n",[194,202,204],{"class":196,"line":203},2,[194,205,206],{},"    current.caller_id == gs.getUserID();\n",[12,208,209],{},"Avoid scripts that grant access when an exception occurs or when a reference is empty. A defensive ACL should fail closed: uncertain authorization should result in no access.",[19,211,213],{"id":212},"_5-check-the-table-hierarchy-and-wildcards","5. Check the Table Hierarchy and Wildcards",[12,215,216,217,220,221,30,223,226],{},"Many task-based applications inherit from the ",[56,218,219],{},"task"," table. An ACL on ",[56,222,219],{},[56,224,225],{},"task.*",", or a parent field can therefore affect Incident, Change, Problem, and custom task tables.",[12,228,229],{},"Use the ACL list and table hierarchy to inspect:",[43,231,232,235,238,243,247],{},[46,233,234],{},"Exact table and field rules",[46,236,237],{},"Parent-table rules",[46,239,240,242],{},[56,241,65],{}," rules",[46,244,245,242],{},[56,246,69],{},[46,248,249],{},"Global wildcard rules",[12,251,252],{},"Before modifying a parent or wildcard ACL, identify every application it may affect. A change intended for one custom table can unintentionally alter access across the platform.",[19,254,256],{"id":255},"_6-keep-scripted-acls-fast","6. Keep Scripted ACLs Fast",[12,258,259],{},"ACLs may execute many times while a form or list renders. A database query inside an ACL can become hundreds of queries during a single interaction.",[12,261,262],{},"Prefer, in order:",[135,264,265,268,271,274],{},[46,266,267],{},"Roles for stable persona-based access",[46,269,270],{},"Conditions using fields already on the current record",[46,272,273],{},"Small, deterministic scripts for relationship-based rules",[46,275,276],{},"Reusable authorization logic only when complexity requires it",[12,278,279],{},"If a query is unavoidable, make it selective, use indexed fields, stop after finding the required answer, and test list performance with realistic data volumes. Never log sensitive record details from ACL scripts in production.",[19,281,283],{"id":282},"_7-fix-the-smallest-correct-scope","7. Fix the Smallest Correct Scope",[12,285,286],{},"Once you know why access failed, choose the narrowest durable solution. That may be:",[43,288,289,292,295,298,301],{},[46,290,291],{},"Adding an appropriate role to an existing ACL",[46,293,294],{},"Correcting a condition that references the wrong state or field",[46,296,297],{},"Creating a field-specific ACL for a defined persona",[46,299,300],{},"Replacing duplicated scripts with a reviewed authorization function",[46,302,303],{},"Fixing a group or role assignment rather than changing the ACL",[12,305,306],{},"Do not deactivate an out-of-box ACL simply because it appears to block the user. It may enforce a platform security boundary. Prefer adding a narrowly scoped rule only after confirming how the complete ACL evaluation will behave.",[19,308,310],{"id":309},"_8-regression-test-both-allowed-and-denied-access","8. Regression-Test Both Allowed and Denied Access",[12,312,313],{},"A security change is incomplete until you test users who should remain blocked. Build a small access matrix covering:",[43,315,316,319,322,325,328],{},[46,317,318],{},"User persona",[46,320,321],{},"Operation",[46,323,324],{},"Record state or ownership",[46,326,327],{},"Expected result",[46,329,330],{},"Actual result",[12,332,333],{},"Test forms, lists, reporting, exports, Workspace, portals, and APIs where relevant. Verify both record and field access. Automated Test Framework tests can preserve these cases and prevent future upgrades or application changes from silently weakening security.",[19,335,337],{"id":336},"final-thoughts","Final Thoughts",[12,339,340],{},"Effective ServiceNow ACL troubleshooting is an evidence exercise. Reproduce the issue as the right user, inspect the actual security evaluation, isolate the failed role, condition, or script, and account for inheritance before editing anything.",[12,342,343],{},"The goal is not merely to make the error disappear. It is to grant the required access to the intended users, through every supported interface, while proving that everyone else remains appropriately restricted.",[345,346,347],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":190,"searchDepth":203,"depth":203,"links":349},[350,351,352,353,354,360,361,362,363,364],{"id":21,"depth":203,"text":22},{"id":76,"depth":203,"text":77},{"id":106,"depth":203,"text":107},{"id":119,"depth":203,"text":120},{"id":154,"depth":203,"text":155,"children":355},[356,358,359],{"id":162,"depth":357,"text":48},3,{"id":168,"depth":357,"text":169},{"id":175,"depth":357,"text":176},{"id":212,"depth":203,"text":213},{"id":255,"depth":203,"text":256},{"id":282,"depth":203,"text":283},{"id":309,"depth":203,"text":310},{"id":336,"depth":203,"text":337},"2026-08-03","Troubleshoot ServiceNow ACLs systematically with Security Rule Debugging, role checks, table hierarchy analysis, scripted ACL testing, and secure design practices.",null,"md",[370,373,376,379],{"question":371,"answer":372},"How do I debug ACLs in ServiceNow?","Enable Debug Security Rules in a safe sub-production session, reproduce the problem as the affected user, and inspect which table or field ACL failed. Check the required roles, condition, and script independently before changing the rule.",{"question":374,"answer":375},"Do table and field ACLs both need to pass in ServiceNow?","Yes. For field access, the user must pass the applicable record-level table ACL and the applicable field ACL. A successful table read ACL does not automatically grant access to every field on that record.",{"question":377,"answer":378},"Does an admin automatically pass every ServiceNow ACL?","Administrators can bypass many ACL checks, but rules can require explicit admin evaluation and some platform security controls behave differently. Testing only as admin is therefore unreliable; reproduce access with a representative non-admin user.",{"question":380,"answer":381},"Should I put GlideRecord queries inside a scripted ACL?","Avoid database queries in ACL scripts when possible because ACLs can run repeatedly while lists and forms render. Prefer roles, conditions, current-record values, or reusable logic designed for efficient authorization checks.","How to Troubleshoot ServiceNow ACLs Without Weakening Security",{},true,"\u002Fblog\u002Fservicenow-acl-troubleshooting-guide",{"title":5,"description":366},"\u002Fimages\u002Fblog\u002Fservicenow-acl-troubleshooting.jpg","blog\u002Fservicenow-acl-troubleshooting-guide","Xqxcw-e0zLNtMZISsTJrS5Z1Ng5uKk6jkTVZoLXZErQ",1786921299109]