ACL Design Pattern for Complex…

advancedTested on Xanadu

The Complex Organizations ACL Design Pattern addresses enterprise scenarios where data visibility requirements cannot be met through simple role or group-based access controls alone. This pattern combines multiple ACL types in a strategic hierarchy, using role-based ACLs for broad permissions, group-based ACLs for departmental boundaries, and script-based ACLs for dynamic conditions based on business logic.

This pattern solves the challenge of implementing sophisticated data governance in organizations with complex reporting structures, geographic distribution, regulatory compliance requirements, or matrix management models. Rather than creating dozens of granular roles, this approach uses a layered security model where each ACL type handles specific aspects of the access decision.

The pattern works by establishing a clear hierarchy where role-based ACLs provide the foundation, group membership determines departmental or regional access, and script-based ACLs evaluate dynamic conditions like record ownership, approval chains, or business relationships. Before-query business rules complement this by pre-filtering data at the database level for performance optimization.

Chrome Extension

Sourdough: ServiceNow Monitoring and Analytics

A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.

Instance HealthGraphs & ChartsAPI HealthDeveloper ToolsQuick SearchInstance Switcher

Add to Chrome

Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.

Overview

Tasks

CMDB

API

Metrics

Monitor

Internals

Instance:sourdoughdev·Version:Yokohama

Instance StateONLINE

System StatusFully Operational

Session Timeout90 minutes

Logged-In Sessions2 (20 active)

Build Nameyokohama-12-18-2024_p1

IP Address10.159.128.43

Instance HealthHealth Score: 90%

🔥 5dSourdough (Chrome Plugin)Dark Mode

Use This When

Use this pattern when your organization has multi-dimensional data access requirements that cannot be satisfied by simple role inheritance alone, such as regional managers who need access to their geographic area across multiple departments, or compliance scenarios where data visibility depends on changing business relationships. This pattern is ideal when performance is critical and you need to minimize the number of ACL evaluations while maintaining precise security boundaries.

Avoid When

Avoid this pattern if your organization has simple hierarchical access requirements that can be met with standard role inheritance, as the added complexity can introduce maintenance overhead and debugging challenges. Do not use this approach if your team lacks advanced ServiceNow security expertise, as misconfigured layered ACLs can create security vulnerabilities or performance bottlenecks that are difficult to diagnose.

Implementation

Server-side

// Script Include: ComplexACLHelper
var ComplexACLHelper = Class.create();
ComplexACLHelper.prototype = {
    initialize: function() {
        this.userSysId = gs.getUserID();
        this.userGroups = this._getUserGroups();
        this.userLocation = gs.getUser().getLocation();
    },

    // Check if user has regional access to record
    hasRegionalAccess: function(recordGR) {
        var userRegion = this._getUserRegion();
        var recordRegion = this._getRecordRegion(recordGR);
        
        // Allow access if same region or user is global manager
        if (userRegion == recordRegion || this._isGlobalManager()) {
            return true;
        }
        
        // Check for cross-regional access via business relationship
        return this._hasBusinessRelationship(recordGR);
    },

    // Check departmental access based on group membership
    hasDepartmentalAccess: function(recordGR) {
        var recordDept = recordGR.getValue('department');
        if (!recordDept) return true; // No department restriction
        
        // Check if user belongs to department group or parent department
        for (var i = 0; i < this.userGroups.length; i++) {
            var groupGR = new GlideRecord('sys_user_group');
            if (groupGR.get(this.userGroups[i])) {
                if (groupGR.getValue('u_department') == recordDept ||
                    this._isParentDepartment(groupGR.getValue('u_department'), recordDept)) {
                    return true;
                }
            }
        }
        return false;
    },

    // Check ownership and delegation rules
    hasOwnershipAccess: function(recordGR) {
        var tableName = recordGR.getTableName();
        
        // Direct ownership
        if (recordGR.getValue('assigned_to') == this.userSysId ||
            recordGR.getValue('opened_by') == this.userSysId) {
            return true;
        }
        
        // Manager delegation - check if user manages the assigned person
        if (recordGR.assigned_to) {
            return this._isManager(recordGR.getValue('assigned_to'));
        }
        
        return false;
    },

    _getUserGroups: function() {
        var groups = [];
        var grMember = new GlideRecord('sys_user_grmember');
        grMember.addQuery('user', this.userSysId);
        grMember.query();
        while (grMember.next()) {
            groups.push(grMember.getValue('group'));
        }
        return groups;
    },

    _getUserRegion: function() {
        var userGR = new GlideRecord('sys_user');
        if (userGR.get(this.userSysId)) {
            var locationGR = new GlideRecord('cmn_location');
            if (locationGR.get(userGR.getValue('location'))) {
                return locationGR.getValue('u_region');
            }
        }
        return '';
    },

    _getRecordRegion: function(recordGR) {
        // Logic varies by table - this example shows incident
        if (recordGR.getTableName() == 'incident') {
            var callerLocation = recordGR.caller_id.location;
            var locationGR = new GlideRecord('cmn_location');
            if (locationGR.get(callerLocation)) {
                return locationGR.getValue('u_region');
            }
        }
        return '';
    },

    _isGlobalManager: function() {
        return gs.hasRole('global_manager');
    },

    _isManager: function(userSysId) {
        var userGR = new GlideRecord('sys_user');
        if (userGR.get(userSysId)) {
            return userGR.getValue('manager') == this.userSysId;
        }
        return false;
    },

    _hasBusinessRelationship: function(recordGR) {
        // Custom business logic for cross-regional access
        var relationGR = new GlideRecord('u_business_relationship');
        relationGR.addQuery('user', this.userSysId);
        relationGR.addQuery('related_region', this._getRecordRegion(recordGR));
        relationGR.addQuery('active', true);
        relationGR.query();
        return relationGR.hasNext();
    },

    _isParentDepartment: function(userDept, recordDept) {
        // Check department hierarchy
        var deptGR = new GlideRecord('cmn_department');
        if (deptGR.get(recordDept)) {
            return deptGR.getValue('parent') == userDept;
        }
        return false;
    },

    type: 'ComplexACLHelper'
};

// Script-based ACL example for incident table read operation
// This would be used in an ACL record with Type='record' and Operation='read'
var aclHelper = new ComplexACLHelper();
var hasAccess = false;

// Layer 1: Role-based foundation (checked automatically by platform)
// Layer 2: Regional access check
if (aclHelper.hasRegionalAccess(current)) {
    // Layer 3: Departmental access check
    if (aclHelper.hasDepartmentalAccess(current)) {
        hasAccess = true;
    }
}

// Layer 4: Override for ownership regardless of region/department
if (!hasAccess && aclHelper.hasOwnershipAccess(current)) {
    hasAccess = true;
}

answer = hasAccess;

The code demonstrates a layered ACL approach using a reusable Script Include that encapsulates complex access logic into distinct methods for regional, departmental, and ownership-based access checks. The ACL script itself becomes clean and readable by delegating to these specialized methods, while the Script Include handles the complex business logic for determining user relationships and permissions. The pattern uses early returns and caching of user attributes to optimize performance when evaluating multiple access conditions.

Alternatives

Before-Query Business Rules with Field-Level Security

Better performance for large datasets by filtering at the query level, but less flexible for complex conditional logic and requires careful coordination between business rules and ACLs to avoid security gaps.

Dynamic Group Assignment with Simple ACLs

Simpler ACL logic by pre-computing access through automated group membership, but requires background processing to maintain group assignments and can lead to group proliferation.

Custom Security Tables with Join Queries

Excellent performance and clear audit trail by maintaining explicit access relationships in custom tables, but requires significant development effort and ongoing maintenance of access data synchronization.

Test Your Knowledge

Quick 3-question quiz — see how your ServiceNow skills stack up.

Question 1 of 3Performance

A list view on a table with millions of records is slow. Best fix?

Select an answer to continue