Skip to content
IT Canvass
Menu
ServiceNow
SailPoint
SAP
TutorialsContact
Development · Lesson

ACL scripting

Quick answer

Access Control Rules (ACLs) decide who can read, write, create or delete a record or field. Most are configured with roles and conditions, but the real power comes from the script field: a snippet that returns answer = true/false for logic the UI can't express.

Key takeaways

  • How an ACL evaluates
  • Debugging access
  • Good habits
  • Try it Yourself

Access Control Rules (ACLs) decide who can read, write, create or delete a record or field. Most are configured with roles and conditions, but the real power comes from the script field: a snippet that returns answer = true/false for logic the UI can't express.

How an ACL evaluates

An operation is allowed only if all three gates pass: the condition, the role requirement, and the script. Any one returning false denies access. ACLs also cascade from field → record → table.

// Field-level ACL: only the assigned agent or a manager can edit var isAssignee = current.assigned_to == gs.getUserID(); var isManager = gs.hasRole('itil_admin'); answer = isAssignee || isManager;
Return via the answer variable. A scripted ACL communicates its verdict by setting answer (not return). Keep scripts fast and side-effect-free, they run on every record the user touches, so a slow ACL script is a platform-wide performance problem.

Debugging access

Use Debug Security Rules to see exactly which ACL granted or denied an operation, the fastest way to resolve 'Security constraints' errors. Remember: no matching ACL at all means deny by default.

Good habits

  • Prefer roles and conditions; reach for script only when necessary.
  • Never run heavy GlideRecord queries inside an ACL.
  • Test as a non-admin, admins bypass most ACLs.

Want to learn this properly?

Our live, instructor-led ServiceNow Training covers this hands-on, with real projects and a certification path.

See the courseAsk a question

Check your understanding

  1. A scripted ACL returns its verdict via...

    • A. the answer variable
    • B. a return statement
    • C. current.update()
    Show answer

    A. the answer variable

    Set answer = true/false to allow or deny.

  2. An operation is allowed only if...

    • A. Condition, role AND script all pass
    • B. Any one gate passes
    • C. The user is logged in
    Show answer

    A. Condition, role AND script all pass

    All applicable ACL gates must pass.

  3. No matching ACL for an operation means...

    • A. Deny by default
    • B. Allow by default
    • C. Prompt the user
    Show answer

    A. Deny by default

    ServiceNow denies access when no ACL grants it.

Frequently asked questions

What does the term ACL scripting refer to in ServiceNow?

Access Control Rules (ACLs) decide who can read, write, create or delete a record or field. Most are configured with roles and conditions, but the real power comes from the script field: a snippet that returns answer = true/false for logic the UI can't express.

What is worth checking first with ACL scripting?

Use Debug Security Rules to see exactly which ACL granted or denied an operation, the fastest way to resolve 'Security constraints' errors.

What is the practical takeaway on ACL scripting?

An operation is allowed only if all three gates pass: the condition, the role requirement, and the script.
CallWhatsAppEnquire