Access Control Rules (ACLs)inServiceNowdeterminewho can access a record, table, or field. They are evaluated in aspecific orderto ensure security.
Table-Level ACLs are evaluated first
ServiceNowfirst checks if the user has permission to access the table itself.
If the user doesnothave access at thetable level, no further checks are performed.
Field-Level ACLs are evaluated next
Once table access is granted, ServiceNow checksif the user has permission to access individual fields.
More specific ACLs override broader ones(e.g.,incident.short_descriptiontakes priority overincident.*).
Order of Specificity (Most Specific to Least Specific)
Field-Specific ACL(incident.short_description.read)
Wildcard Field ACL(incident.*.read)
Table-Level ACL(incident.read)
Wildcard Table ACL(*.read)
ACL Evaluation Order in ServiceNow:This ensures thatspecific rules take precedence over general rulesfor enhanced security.
Example of ACL Evaluation in Incident Table:ACL Rule Type
Example ACL
Evaluation Order
Field-Specific
incident.short_description.read
First (Most Specific)
Wildcard Field
incident.*.read
Second
Table-Level
incident.read
Third
Wildcard Table
*.read
Last (Most General)
A. Field-level - most general to most specific; then Row-level - most specific to most generalIncorrect– Field-level ACLs arenot evaluated first; table-level ACLs are checked before field-level.
B. Table-level - most specific to most general; then Row-level - most specific to most generalIncorrect–"Row-level" is not a correct termin ServiceNow ACL processing.
D. Field-level - most specific to most general; then Table-level - most specific to most generalIncorrect–Table-level ACLs are always evaluated before field-level ACLs.
Incorrect Answer Choices Analysis:
ServiceNow Docs – Access Control Evaluation Order????How ACLs Are Processed
ServiceNow Docs – Managing ACLs in ServiceNow????Best Practices for ACLs
Official ServiceNow Documentation References:
Conclusion:The correct answer is:
C. Table-level - most specific to most general; then Field-level - most specific to most general
Thisensures that general table permissions are granted before checking field-level access,following a structured and secure approachto access control in ServiceNow.
Submit