Debugging ACLs
Quick answer
Use the security debugger, read the evaluation order, and fix access problems without granting admin.
Key takeaways
- Elevate to security_admin before debugging
- The debugger names the deciding rule
- Table and field denials need different fixes
- Adding admin is never the answer
Turn on the debugger
Elevate to security_admin, then enable Debug Security Rules from the system settings or the debug menu. Reload the record and the page shows every ACL evaluated, in order, with the result.
Reading the output
Look for the rule that returned false, and note whether it was a table rule or a field rule. A denial on incident.* write is a different fix from a denial on incident.state write, even though the symptom is the same.
Fixing properly
Resist the temptation to add a role.
- Grant the narrowest access that solves the case
- Never fix an ACL problem by giving the user admin
- Check whether the correct answer is a new role rather than a change to an existing ACL
- Re test with impersonation and turn the debugger off afterwards
Want to learn this properly?
Our live, instructor-led ServiceNow Training covers this hands-on, with real projects and a certification path.
Check your understanding
What role is required to enable security debugging?
- A. itil
- B. security_admin elevated
- C. admin only
- D. impersonator
Show answer
B. security_admin elevated
Security rule debugging requires elevated privilege.
What is the correct fix for a legitimate access gap?
- A. Grant admin
- B. Grant the narrowest role or adjust the specific ACL
- C. Disable the ACL
- D. Impersonate permanently
Show answer
B. Grant the narrowest role or adjust the specific ACL
Least privilege keeps the security model intact.