Cross-Scope Access Error

[VullankiL]

Hi All,

We are facing a cross-scope access error when using @mention in Work Notes or Additional Comments on tables that are created in a custom application scope (EITG) and extend from the Task table (Global scope).

Error message:

Access to API 'setWorkflow' from scope 'x_weoi2_eitg_conf' has been refused due to the API's cross-scope access policy. 

Access Details: setWorkflow can only be called from within the same Scope as the Table on which it is called. 

Table's Scope was: "Global", but executing Scope was: "EITG".

What we checked:

• This happens only when an @mention is added in Work Notes or Additional Comments.
• Occurs in both DEV and PROD with any user.
• We searched all Business Rules, Script Includes, UI Actions, and Flows in our app scope (EITG). Only one Script Include had a setWorkflow(false) line, which we commented, but the error still persists.
• It seems the error is triggered by the OOB @mention journal field processor, not by our custom code.

Our Question:

• Has anyone else faced this issue on scoped Task extensions?
• Is there a recommended workaround to handle @mentions without hitting the cross-scope setWorkflow restriction?

[Sarthak Kashyap]

Hi @VullankiL ,

Can you allow the access from All> System Application > Application restricted caller access, check for your scope and target scope if created mark it allow otherwise create new.

Please mark my answer correct and helpful if this works for you

Thanks,

Sarthak

[VullankiL]

Hi @Sarthak Kashyap ,

My Application scope is "EITG". So, with EITG as Application Scope, and Global as Target Scope, there are no records. How to create new?
Could you please explain..

Thank you

[Sarthak Kashyap]

Hi @VullankiL ,

You can refer below screenshot

Try to create new record and check by clearing cache or logout/login once.

Also check if there is any script include is also doing setWorkflow false so in that case change source type as script include and add speicific script include name 

Please mark my answer correct and helpful if this works for you

Thanks,

Sarthak

[Manikandan Than]

Hello @VullankiL ,

This error arises because of ServiceNow’s cross-scope access protection. In short:

• The setWorkflow API is defined in the Global scope (or acts upon a table in the Global scope).

• Your executing script or application is in the EITG (x_weoi2_eitg_conf) scope.

• ServiceNow’s policy disallows calling certain APIs across scopes for security and modularity reasons (i.e. you cannot call an API on a Global table from within a custom scoped application unless permission is granted).

• Thus, the system refuses the access because the scopes don’t align.
  
  

  Here are the common approaches to address this issue:

  1. Move the script into the Global scope
     If possible, host the script or business logic in the Global scope (or in the same scope as the target table). That way, when it calls setWorkflow, it's aligned with the table’s scope, avoiding cross-scope violations.

  2. Grant explicit cross-scope access permission
     You can configure cross-scope privileges to allow the EITG scope (your scope) to call setWorkflow in the Global scope, but only if ServiceNow allows it for that particular API. Use the “Cross-Scope Privileges” or “Cross-Scope Access” configuration (if supported) to grant permission.
     
     See the ServiceNow Support article on granting cross-scope access: ServiceNow Support
     
     Best Regards,
     Manikandan