Skip to content
IT Canvass
ServiceNow Troubleshooting · Lesson

Debugging ACLs

Quick answer

Use the security debugger, read the evaluation order, and fix access problems without granting admin.

Key takeaways

  • Elevate to security_admin before debugging
  • The debugger names the deciding rule
  • Table and field denials need different fixes
  • Adding admin is never the answer

Turn on the debugger

Elevate to security_admin, then enable Debug Security Rules from the system settings or the debug menu. Reload the record and the page shows every ACL evaluated, in order, with the result.

Reading the output

Look for the rule that returned false, and note whether it was a table rule or a field rule. A denial on incident.* write is a different fix from a denial on incident.state write, even though the symptom is the same.

Fixing properly

Resist the temptation to add a role.

  • Grant the narrowest access that solves the case
  • Never fix an ACL problem by giving the user admin
  • Check whether the correct answer is a new role rather than a change to an existing ACL
  • Re test with impersonation and turn the debugger off afterwards

Want to learn this properly?

Our live, instructor-led ServiceNow Training covers this hands-on, with real projects and a certification path.

Check your understanding

  1. What role is required to enable security debugging?

    • A. itil
    • B. security_admin elevated
    • C. admin only
    • D. impersonator
    Show answer

    B. security_admin elevated

    Security rule debugging requires elevated privilege.

  2. What is the correct fix for a legitimate access gap?

    • A. Grant admin
    • B. Grant the narrowest role or adjust the specific ACL
    • C. Disable the ACL
    • D. Impersonate permanently
    Show answer

    B. Grant the narrowest role or adjust the specific ACL

    Least privilege keeps the security model intact.

Frequently asked questions

Why does the debugger show so many rules?

Every ACL that could apply is evaluated, including inherited ones from parent tables. Read for the specific denial rather than the volume.

Is it safe in production?

It is verbose and only affects your session, but turn it off when you finish. Prefer reproducing the issue in a sub production instance where possible.
CallWhatsAppEnquire