What is an ACL (Access Control List) in ServiceNow?

Why This Matters in an Interview

Security is a core topic in every ServiceNow interview. ACLs control who can read, write, create, and delete data — and they're enforced automatically across the entire platform.

What Is an ACL?

An ACL is a security rule that controls access to tables, records, and individual fields. When a user tries to view an incident, update a change request, or delete a CI — the platform checks the ACLs to determine if that action is allowed.

The Three Components of an ACL

• 1. Roles: Which role(s) does the user need? e.g., itil, admin, incident_manager. A user must have the specified role to pass this check.
• 2. Conditions: Filter conditions on the record. e.g., 'Only if the record is assigned to the user's group.' This provides row-level security.
• 3. Script: Advanced JavaScript logic for complex authorization. Returns true (allow) or false (deny).

// ACL Example:
// Table: incident
// Operation: write
// Role required: itil
// Condition: active=true
// Meaning: Users with 'itil' role can edit incidents, but only active ones

// ACL Script Example:
// Allow editing only if the incident belongs to the user's assignment group
answer = gs.getUser().isMemberOf(current.assignment_group);

Evaluation Order

• ACLs are matched from most specific to least specific — the first match at each level is the one that gets evaluated:
• incident.caller_id — field-level ACL (most specific)
• incident.* — table-level ACL
• *.* — global ACL (least specific)
• To reach a field, the user must pass both the matching field-level ACL and the matching table-level ACL. But when several ACLs match at the same point (e.g., two ACLs on incident.caller_id), passing any one of them grants access (OR) — so adding another ACL at the same level can actually loosen access.

Key Facts for Interviews

• Deny by default: If no ACL grants access, access is denied. Unlike some systems where everything is open unless restricted.
• Admin bypasses ACLs: Users with the admin role skip ACL checks entirely (unless the ACL script explicitly handles admin).
• Applies everywhere: ACLs enforce on UI, REST API, list views, reports, exports — not just forms.