ACL Related

[VaidehiL]

In service now there are two ACL's one is giving access and other is rejecting access but rejecting one has script condition so whose priority is greater . Does script ACL has higher priority?

[Simon Christens]

Hi,

The short answer is No.

ACLs doesnt use prority. You can have alot of ACLs rejcting you but as soon as an ACL gives you access (Evals true) then you will be granted access.

For ex:

Incident read ACL requires ITIL role (gives fulfillers access) - then theres another that grants you access to read if you are the caller and this one doesnt require any roles (gives end users access to their own incidents)

Theres plenty of posts here explaining ACLs and how they work.

Ex:

https://www.servicenow.com/community/grc-forum/order-of-execution-of-an-acl/m-p/1311960 

Regards,

Simon

[Ankur Bawiskar]

@VaidehiL 

no dependency with advanced script etc

if any 1 table level ACL allows access the access is granted

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[yashkamde]

Hello @VaidehiL ,

If you have two separate ACL rules targeting the exact same object and same operation:

Access will be GRANTED.

ServiceNow evaluates multiple matching ACLs as a logical OR. If at least one ACL evaluates to true, access is allowed.

If my response helped mark as helpful and accept the solution.

[glideFather]

ahoy @VaidehiL,

you can use Access Analyzer to compare the permissions - select user, table and optionally a particular record and you will see how it is evaluated - scripts, roles, conditions, ...