ServiceNow Troubleshooting · LessonBy Neelima, ServiceNow Architect · Published · ServiceNow · all levels
Debugging ACLs
Use the security debugger, read the evaluation order, and fix access problems without granting admin.
Quick answer
Use the security debugger, read the evaluation order, and fix access problems without granting admin.
Key takeaways
- Elevate to security_admin before debugging
- The debugger names the deciding rule
- Table and field denials need different fixes
- Adding admin is never the answer
Turn on the debugger
Elevate to security_admin, then enable Debug Security Rules from the system settings or the debug menu. Reload the record and the page shows every ACL evaluated, in order, with the result.
Reading the output
Look for the rule that returned false, and note whether it was a table rule or a field rule. A denial on incident.* write is a different fix from a denial on incident.state write, even though the symptom is the same.
Fixing properly
Resist the temptation to add a role.
- Grant the narrowest access that solves the case
- Never fix an ACL problem by giving the user admin
- Check whether the correct answer is a new role rather than a change to an existing ACL
- Re test with impersonation and turn the debugger off afterwards
Practice challenge
+0 XPStreak ×0
Question 1 of 2
What role is required to enable security debugging?
Frequently asked questions
Why does the debugger show so many rules?
Every ACL that could apply is evaluated, including inherited ones from parent tables. Read for the specific denial rather than the volume.
Is it safe in production?
It is verbose and only affects your session, but turn it off when you finish. Prefer reproducing the issue in a sub production instance where possible.