Question 1

What causes ACL Not Restricting Access in ServiceNow?

Accepted Answer

User has admin role which bypasses ACLs — Check the user's roles in User Administration > Users. Look for admin, security_admin, or other elevated roles in their Roles related list. Admin role bypasses all ACL restrictions by design. ACL Roles field is empty allowing everyone access — Navigate to System Security > Access Control (ACL) and open your ACL record. Check if the Roles field is completely empty - this grants access to all users regardless of their roles. Higher priority ACL is granting access — In System Security > Access Control (ACL), filter by your table and field. Look for other ACLs with lower Order values (higher priority) that have type 'allow' and matching conditions. ACL condition script has error defaulting to allow — Check the Script field in your ACL record for syntax errors or logic issues. Review System Logs > All for JavaScript errors when the ACL executes. ACL is on wrong table or not inherited properly — Verify the Table field in your ACL matches the exact table where the restriction should apply. Check if the target table extends another table that might have conflicting ACL rules. Elevated security_admin session is active — Look for the security_admin elevation banner at the top of the screen. Active elevation bypasses ACL restrictions during the elevated session.

Question 2

How do you fix ACL Not Restricting Access in ServiceNow?

Accepted Answer

How to fix it Navigate to User Administration > Users and open the user record that shouldn't have access. Check the Roles related list. If you see admin, security_admin, or other elevated roles, remove them or test with a non-admin user. Go to System Security > Access Control (ACL) and locate your ACL record. Open the ACL and verify the Roles field is not empty. If empty, add the appropriate roles that should have access. Confirm the Table field matches exactly where you want the restriction applied. Check if conflicting ACLs exist by filtering the ACL list by your table name and looking for other rules with lower Order values (higher priority). If you find conflicting ACLs, either modify their conditions, change their order, or set them to Active = false if they're no longer needed. Review any condition script in the Script field for syntax errors or incorrect logic that might return true unintentionally. Check System Logs > All for any JavaScript errors when your ACL executes, which could cause it to default to allowing access. Verify the ACL Type field matches your intent (record, field, or table-level restriction). Test the ACL by impersonating a user who should be restricted through System Administration > Users > Impersonate User.

Question 3

How do you prevent ACL Not Restricting Access in ServiceNow?

Accepted Answer

Always test ACLs with non-admin users or use impersonation to verify restrictions work as expected before deploying to production. Use the ACL naming convention that includes table name and purpose (e.g., 'incident.read.itil_only') to avoid confusion with existing rules. Document ACL dependencies and conflicts in the Description field, especially when multiple ACLs affect the same table or field. Set up regular ACL audits using reports to identify empty roles fields or conflicting rules that may grant unintended access. Always specify required roles in the Roles field rather than relying solely on condition scripts, as empty roles grant universal access.

ACL Not Restricting Access in ServiceNow

Symptom

Possible Causes

Debugging this in a real instance?

Solution

How to fix it

Prevention Tips

Test Your Knowledge