Can any explain the difference between ACL with tablename-none and ACL with tablename-*

[mayanksinghrath]

Suppose I have a table with 40 columns I want to show the end user only 10 columns how to do that?

[Vaishnavi Lathk]

Hello @mayanksinghrath ,

Difference between ACL with tablename - None and ACL with tablename - *:

• tablename - None
  • Controls access only at the table level.
  • Determines whether a user can see or perform actions on the table itself.
  • If a user fails this ACL, they cannot access the table or its records at all.
• tablename - *
  • Controls access for all fields in the table.
  • The user may see the table exists but cannot view or edit any fields if they fail this ACL.

Simple way to remember:

• None → Table-level control
• * → All fields in the table

How to show only 10 columns out of 40 to users:

1. Use Form Layout / Form Designer to show only the 10 fields.
2. Apply field-level ACLs to hide the other 30 fields.
3. Optionally, create a list or view showing only the 10 columns.

Use a combination of form layouts and field ACLs for full control over what users can see and edit.

[Bhavya11]

Hi @mayanksinghrath ,

Table.*  is a field level ACL which gives Access to all field on that table.

Table.none  is a row level ACL which allows you to access records.

Both are table level ACL, But the thing is * is a wild card entry. Suppose None is restricting table level access and you provide access by using * , system can allow you to do the work.

For reference:

https://www.servicenow.com/community/itsm-forum/what-is-the-difference-between-and-none-in-acl/m-p/4...

[kumkumr]

ACL with tablename: none vs ACL with tablename

These two ACL configurations control how access is granted to resources, and they serve quite different purposes.

---

What is ACL (Access Control List)?

An ACL is a set of rules that defines who can do what on which resource. Every rule typically contains:

• Role → Who is performing the action (e.g., admin, editor, viewer)
• Tablename → What resource is being accessed
• Operation → What action is being performed (create, read, update, delete)
• Permission → Allow or Deny

---

1. ACL with tablename: none

What it means:

When tablename is set to none, the ACL rule is not linked to any database table. It governs access to functional resources — things that exist in the application layer, not the data layer.

When is it used?

• Controlling access to UI pages or screens
• Controlling access to API routes or endpoints
• Controlling access to system-level features like settings, exports, imports, dashboards
• Controlling access to menu items or navigation
• Any permission that is about "can they use this feature" rather than "can they access this data"

ACL with a specific tablename

What it means:

When tablename is set to a real table name (e.g., users, orders, products), the ACL rule is directly tied to that database table. It governs what a role can do with the actual data stored in that table.

When is it used?

• Allowing a role to read rows from a table
• Restricting a role from inserting or deleting records
• Defining column-level access (which fields are visible)
• Enforcing row-level security (only see your own records)
• Any permission that is about "can they touch this data"

[Aditya_hublikar]

Hello @mayanksinghrath ,

Please refer this thread :

https://www.servicenow.com/community/developer-forum/access-controls-table-none-vs-table-what-s-the-...

If this helps you then mark it as helpful and accept as solution .

Regards ,

Aditya