Administration · LessonBy Praveen T, ServiceNow Trainer, 9 yrs · Published · ServiceNow · all levels
Field security and data policies
Control who reads and writes individual fields, and enforce rules that apply to imports as well as forms.
Quick answer
Control who reads and writes individual fields, and enforce rules that apply to imports as well as forms.
Key takeaways
- Field ACLs are table.field, wildcards catch the rest
- Data policies enforce on every write, UI policies only in the browser
- Use the debugger to find the deciding rule
- New fields inherit wildcards, so review after each release
Field ACLs
A field ACL controls read or write on one column, written as table.field. A wildcard such as incident.* covers every field not explicitly listed. When users can see something they should not, a permissive wildcard is usually the reason.
Data policies versus UI policies
A UI policy runs in the browser and can be bypassed by an import or an API call. A data policy runs on the server for every write, including imports and web services. Anything that must always be true belongs in a data policy.
Working practices
Field security is where instances quietly drift.
- Document why each restrictive ACL exists, in its description
- Use the security debugger rather than guessing which rule applied
- Convert critical UI policies to data policies for integration safety
- Review field ACLs after each release, new fields inherit the wildcard
Practice challenge
+0 XPStreak ×0
Question 1 of 2
Which enforces mandatory on an import?
Frequently asked questions
Can a data policy be converted to a UI policy?
Yes, the record has an option to create the matching UI policy so users get immediate feedback while the server rule still enforces it.
Why is my field still editable through the API?
The rule is a UI policy. Move it to a data policy or a field ACL.