ACL Evaluation: Admin Overrides and A System Property

[Allen Andreas]

ACL Evaluation: Admin Overrides and A System Property

Just when you thought you knew all there is to know about ServiceNow ACLs, a little "gotcha" pops up and can change the behavior from what you'd normally expect. It's time for another ServiceNow random trivia fact, haha.

Did you know...

There's a system property called: glide.security.admin.override.accessterm

That system property controls the behavior of the "Admin overrides" checkbox on an ACL. Normally, in the world of ACLs, once you pass at least one ACL for a given object (table, table.field, etc.), the individual can do whatever the ACL is allowing them to do (read, write, etc.).

• If that system property's value is true, then yes, "Admin overrides" works just like that.
• If that system property's value is false...then...no..."Admin overrides" does not work like that.

What ends up happening is that when that system property is false...if there's multiple ACLs on the same object (table, table.field, etc.)...then even if one of those ACLs has the "Admin overrides" checkbox unchecked (false), it...overrides...all other ACLs on that same object (even if the "Admin overrides" checkbox is checked (true)) -- this results in the user not passing if "Admin overrides" was the only way they'd get access to that it.

The default value for that system property is true and has been that way since the Geneva release (when this was introduced), but it's important to be aware of this configuration setting as someone could change that system property value resulting in skewed behavior that most of us expect when working with ACLs.

More information about this functionality and configuration can be found here.

If you enjoy ServiceNow content like this, please consider following me on LinkedIn as well as subscribe to my ServiceNow focused YouTube channel: Allenovation! -- which just passed 2,000 subscribers!