Need help in ACL, How it works

[David Cross]

Hello All, i am new to ACL and trying to understand it. Can you please help me with the outputs here...

I have a table called [ Collector with Fields => Name, Email, Amount, Due, Status ]

				Question	Please help me with the outputs
Read	Table.None	Admin	Role X
Read	Table.*	Role X		What will Admin see
Read	Table.Email	Admin		what will Role X see
Write	Table.None	Role X
Write	Table.*	Admin	Role X	what will both see
Write	Table.Email	Admin		what will Role X see
Read	Table.None	No Role	No Role
Read	Table.*	admin		what will both see
Read	Table.name	Role X		what will both see
Read	Table.None	No Role	No Role
Read	Table.*	Role X	Admin	what will both see
Read	Table.Name	Role X		What will Admin see
Delete	Table.None	Admin	Role X
Delete	Table.*	Admin		what will Role X see
Delete	Table.Email	Admin		what will Role X see

[Sandeep Rajput · Accepted solution]

@David Cross 

			Question	Please help me with the outputs
Read	Table.None	Admin	Role X	Here table level ACL access has been given to Admin and Role X
Read	Table.*	Role X		What will Admin see 1. If Admin override is checked then admin will have read access to all fields 2. If Admin override is unchecked and Admin doesn't have Role X then he will not be able to read any fields on table 3.  If Admin override is unchecked and Admin have Role X then he will be able to read any fields on table
Read	Table.Email	Admin		what will Role X see Since Role X already have Table.* access he will be able to have read access to Email field.
Write	Table.None	Role X		Here table level ACL write access has been given to Role X
Write	Table.*	Admin	Role X	what will both see Here table level ACL write access has been given to Admin and Role X
Write	Table.Email	Admin		Since Role X already have Table.* write access he will be able to have write access on Email field.
Read	Table.None	No Role	No Role	No roles are allowed to have table level read access
Read	Table.*	admin		If Admin override on Table.None is checked then admin will be able to have read access on all fields If Admin override on Table.None is unchecked then admin will not be able to have read access on any fields
Read	Table.name	Role X		what will both see Role X will not be able to read any fields(including name) on the table If Admin override on Table.None is checked then admin will be able to have read access on name field If Admin override on Table.None is unchecked then admin will not be able to have read access on name field
Read	Table.None	No Role	No Role	No roles are allowed to have table level read access
Read	Table.*	Role X	Admin	Role X will not be able to read any fields on the table If Admin override on Table.None is checked then admin will be able to have read access on all fields If Admin override on Table.None is unchecked then admin will not be able to have read access on any fields
Read	Table.Name	Role X		What will Admin see 1. If Admin override is checked then admin will have read access on name field 2. If Admin override is unchecked and Admin doesn't have Role X then he will not be able to read name field on table 3.  If Admin override is unchecked and Admin have Role X then he will be able to read name field on table
Delete	Table.None	Admin	Role X	Table level delete permission is given to Admin and Role X
Delete	Table.*	Admin		what will Role X see Role X will not be able to Delete rows on the table
Delete	Table.Email	Admin		what will Role X see Role X will not be able to Delete rows on the table

Hope this helps.

[Bert_c1]

See: exploring-access-control-list

[Community Alums]

Hi @David Cross ,

You may take a look into the below docs hope this helps-

https://docs.servicenow.com/bundle/washingtondc-platform-security/page/administer/contextual-securit...

https://docs.servicenow.com/bundle/utah-platform-security/page/administer/contextual-security/concep...

Also please find the below answer to your queries-

				Question	Please help me with the outputs
Read	Table.None	Admin	Role X		No one has read access to the table by default.
Read	Table.*	Role X		What will Admin see	Admin can read all fields because there is no specific restriction for Admin on the entire table, and Admin has read access to the Email field.
Read	Table.Email	Admin		what will Role X see	Role X can read all fields except Email because the Email field is restricted to Admin.
Write	Table.None	Role X			Role X has no write access by default.
Write	Table.*	Admin	Role X	what will both see	Admin can write to all fields.
Write	Table.Email	Admin		what will Role X see	Role X can write to all fields except Email.
Read	Table.None	No Role	No Role		No role means no access by default.
Read	Table.*	admin		what will both see	Admin can read all fields.
Read	Table.name	Role X		what will both see	will see nothing because no read access is provided at table level
Read	Table.None	No Role	No Role		No role means no access by default.
Read	Table.*	Role X	Admin	what will both see	Admin can read all fields because Admin has been granted access to the entire table.
Read	Table.Name	Role X		What will Admin see	Role X can read all fields, including Name, as it has specific read access to the Name field.
Delete	Table.None	Admin	Role X		Both Admin and Role X can delete records by default.
Delete	Table.*	Admin		what will Role X see	Only Admin can delete all fields.
Delete	Table.Email	Admin		what will Role X see	Only Admin can delete the Email field.

I hope this helps.

If my response has resolved your query, please consider giving it a thumbs up ‌‌ and marking it as the correct answer‌‌!

Thanks & Regards,

Sanjay Kumar