ACL Applies to VS Data condition

[AnthonyMull]

Hi Community

can someone please help me to understand the difference between the following sections of an ACL

> Applies to (This limits the records that the ACL applies to)

>Data condition. (I dont understand what this section does?)

Kind regards

[Shubhras]

Hello Anthony,

The ‘applies_to’ field defines whether the ACL applies to specific records. If it’s left empty, the ACL applies to all records in the table.

The ‘data condition’ determines how the ACL is evaluated — it checks whether the specified condition matches the record. Based on this evaluation, the system either grants or denies access.

In simple terms, ‘applies_to’ decides where the ACL should be enforced, while the condition decides whether access should be allowed or restricted for those records.

Please mark my answer helpful if it resolves your query.

[Bhuvan]

@AnthonyMull 

Below article will help you to understand the 'Applies to' and 'Data condition' options used in ACL

https://www.servicenow.com/community/upgrades-and-patching-forum/xanadu-new-acl-feature-applies-to-e...

If this helped to answer your query, please mark it helpful & accept the solution.

Thanks,

Bhuvan

[Sarthak Kashyap · Accepted solution]

Hi @AnthonyMull ,

Applies to
This part tells ServiceNow which records the ACL should even look at.
If a record doesn’t meet what you put here, the ACL is completely ignored for that record.

Example:
If “Applies to” says Active is true, then inactive records won’t even run this ACL.

Data condition
This comes into play only after the ACL has decided to run.
It checks something about the record’s values to decide if access should be allowed.

Only allow updates to active incident records.

Example:
If the data condition says Priority is 1, the access rule only matters when the record is priority 1.
If it’s priority 3 → access is allowed without questioning.

Link - https://www.servicenow.com/docs/bundle/zurich-platform-security/page/administer/contextual-security/...

Please mark my answer correct and helpful if this works for you

Thanks and Regards,
Sarthak

[Bhimashankar H]

Hi @AnthonyMull ,

“Applies to”: Filters entire records—if a record does not match, the ACL isn’t checked for it. In general high level record filter.

First, to decide if ACL should fire. Filters which record the rest of the ACL logic will be evaluated against. It’s a top-level filter before conditions/scripts/etc.

E.g: State is not in Closed

“Data condition”: Evaluates detailed criteria about the record—if these aren’t true, access is denied, even if “Applies to” is true. Row field specific.

After “Applies to”, more granular. Acts as a flexible “when” test for the row/field, in conjunction with the other ACL logic. If the data condition isn’t met, the ACL immediately returns false for that record—even if the user meets role/script checks.

E.g: Priority is High, Assigned to me.

Use both together for fine-grained ACL control!

Thanks,
Bhimashankar H

-------------------------------------------------------------------------------------------------
If my response points you in the right directions, please consider marking it as 'Helpful' & 'Correct'. Thanks!