Q: What causes Role Not Granting Expected Access in ServiceNow?

Session cache not refreshed after role assignment — Navigate to User Administration > Users, find the user, check the Roles tab shows the role with current timestamp. The role assignment exists but user's active session still has old permissions cached. Module requires different role than expected — Go to System Definition > Modules, find the specific module user can't access, check the 'Roles' field. Compare this to the role you actually assigned - they often don't match assumptions. ACL requires multiple roles but user only has subset — Navigate to System Security > Access Control (ACL), filter by the table user can't access. Check if ACLs have multiple roles in 'Required role' field or complex script conditions requiring role combinations. Role inheritance from group not working — Check sys_user_grmember table shows user in correct group, then verify group has role in sys_group_has_role table. Look for 'Inherited' column showing false when it should be true. Role assigned to wrong user record — Query sys_user_has_role table directly with the role's sys_id to see which user records actually have it. Sometimes assignment goes to duplicate or inactive user records.

Question 1

What causes Role Not Granting Expected Access in ServiceNow?

Accepted Answer

Session cache not refreshed after role assignmenthigh likelihood

Navigate to User Administration > Users, find the user, check the Roles tab shows the role with current timestamp. The role assignment exists but user's active session still has old permissions cached.

Module requires different role than expectedhigh likelihood

Go to System Definition > Modules, find the specific module user can't access, check the 'Roles' field. Compare this to the role you actually assigned - they often don't match assumptions.

ACL requires multiple roles but user only has subsetmedium likelihood

Navigate to System Security > Access Control (ACL), filter by the table user can't access. Check if ACLs have multiple roles in 'Required role' field or complex script conditions requiring role combinations.

Role inheritance from group not workingmedium likelihood

Check sys_user_grmember table shows user in correct group, then verify group has role in sys_group_has_role table. Look for 'Inherited' column showing false when it should be true.

Role assigned to wrong user recordlow likelihood

Query sys_user_has_role table directly with the role's sys_id to see which user records actually have it. Sometimes assignment goes to duplicate or inactive user records.

Question 2

How do you fix Role Not Granting Expected Access in ServiceNow?

Accepted Answer

How to fix it Force session refresh by having the user completely log out (not just close browser tab), clear browser cache, then log back in. This eliminates cached permissions in 90% of cases. Navigate to System Definition > Modules and search for the exact module name the user can't access. Open the module record and check the Roles field. Note the exact role names required - these might be different from what you assigned. Go to User Administration > Users, find the user, and assign the exact roles listed in the module's Roles field. If user still can't see records, navigate to System Security > Access Control (ACL) and filter by the table name (e.g., incident, change_request). Check each ACL's Required role field and Script field for complex conditions. Look for multiple role requirements or role hierarchy dependencies. If ACLs require multiple roles, assign all required roles to the user through User Administration > Users > [User] > Roles tab. For group-inherited roles, go to User Administration > Groups, find the user's group, check the Roles tab, and verify Inherited is checked. Verify the user is actually in the group by checking User Administration > Users > [User] > Groups tab or the group's Members tab. If role inheritance isn't working, manually assign the role directly to the user as a workaround, then investigate group membership sync issues. Double-check role assignment by querying sys_user_has_role table with condition user.user_name=[username] to see all roles.

Question 3

How do you prevent Role Not Granting Expected Access in ServiceNow?

Accepted Answer

Always verify module role requirements in System Definition > Modules before assigning roles - don't assume role names match module names. Create a role assignment checklist that includes forcing user logout/login as a required verification step. Use role hierarchy (contained roles) instead of requiring multiple individual role assignments when possible to reduce ACL complexity. Set up Security Debugging (elevated logging) in a test environment to trace role evaluation when designing new role structures. Document custom ACL requirements and non-standard role dependencies in your role descriptions for future administrators.

Role Not Granting Expected Access in ServiceNow

Symptom

Possible Causes

Debugging this in a real instance?

Solution

How to fix it

Prevention Tips

Test Your Knowledge