ACCESS CONTROL
LIST (ACL) IN
SERVICENOW
QUICK GUIDE
ACL is a core security mechanism in
ServiceNow, yet it is often
misconfigured.
In this post, I will show you how to
properly design ACLs, avoid
common mistakes, and apply best
practices.
What is an ACL in ServiceNow?
An Access Control List (ACL) is a set of
rules defining who can access what
data and under what conditions in
ServiceNow.
ACL rules apply at three levels:
✔ Table – controls access to an entire
table
✔ Field – controls access to a specific
field in a table
✔ Record – checks permissions for a
specific record
ACL rules apply to the following
operations:
read – viewing data
write – editing data
create – creating new records
delete – removing records
Example ACL rule:
Table: incident
Field: short_description
Operation: read
Condition: The user must be part of the
"IT Support" group
How ACLs Work in ServiceNow?
Each ACL rule is evaluated in the
following order:
1️⃣
Table ACLs – if a user has no
access, further ACLs won’t be
checked.
2️⃣Field ACLs – if table access is
granted, field ACLs are verified.
3️⃣Record ACLs – additional record-
level restrictions apply.
🔍 Important: ACLs in ServiceNow follow
an "at least one must be true" (OR)
principle. If no ACL grants access, access is
denied.
Misconfiguration Example
A table-level ACL on incident
denies access to everyone except
admin.
A field-level ACL allows itil to read
short_description.
Outcome: The itil user still can’t
see the field!
✅ Rule: Grant table access first, then
control fields and records.
Advanced ACLs
Dynamic Conditions – ACLs without
scripting
Define ACL conditions visually
without JavaScript.
Example:
ACL on incident allows access if:
The user is Assigned to the
incident.
The user is in the Assignment
group.
Best Practices for ACLs
Follow the Least Privilege Principle –
Grant only the minimum permissions
necessary.
Use a hierarchical ACL structure –
Apply ACLs from table level to field
level to avoid redundant rules.
Avoid admin-based ACLs – The admin
role bypasses ACLs, which can create
security risks.
Use gs.hasRole() instead of
GlideRecord – Role checks are faster
than database queries.
Optimize ACL scripts – Long scripts in
ACLs can slow down system
performance.
Example of an optimized ACL script:
answer = gs.hasRole("it_support") ||
gs.getUser().getDepartment() == "IT";
This condition checks the user’s role
and department without unnecessary
database queries.
Common ACL Mistakes
❌ Missing field-level ACLs – If a table
has an ACL but fields don’t, users
might still see sensitive data!
❌ Overly broad rules – e.g., role=itil
grants access to all incidents, which
can be risky.
❌ Inefficient scripts – Using
GlideRecord queries in ACL scripts can
slow down the system.
❌ Incorrect ACL order – ACLs
should be structured from general to
specific for clarity.
Case Study: Improving ACL
Performance in a Large
Organization
Problem: A company faced slow form
loading times in the incident module.
The analysis revealed:
50+ ACL rules applied at the field
level
ACL scripts using GlideRecord to
query large tables
Role checks written inefficiently
Solution:
Reduced ACL count from 50 to 12 by
refactoring conditions
Replaced GlideRecord queries with
gs.hasRole()
Moved some logic from ACLs to Data
Policies
Result: 40% faster form load times! 🚀
ACL Debugging Tools
Debug Security Rules – shows applied
ACLs.
Security Access Analyzer – identifies
ACL conflicts.
Access Control Debug Mode –
visualizes ACL restrictions.
Tip: Always start debugging with
Debug Security Rules!
Pro Tips for Developers
Regularly debug ACLs – Use Debug
Security Rules to verify which rules are
applied.
Test with end-user roles – Logging in
as an end user helps verify real access
levels.
Avoid duplicate ACLs – If table and
field ACLs are identical, remove
redundant rules.
Manage access through roles –
Instead of adding users to ACLs, assign
roles and use gs.hasRole().
ACLs are a critical security mechanism
in ServiceNow – misconfiguration can
lead to data breaches and
performance issues.
Following best practices helps avoid
common mistakes and optimizes
system performance.
Debugging and testing ACLs is an
essential step in every implementation.
💬 What are your biggest
challenges with ACLs in
ServiceNow? Share in the
comments!
I hope this information was
helpful to you. If you would like
to add something, please
comment. If you have any
questions, write!
If you want more interesting
information, please follow my
profile.
Thank you :)
