Unable to Make "admin" Role Visible in sys_user_role List Despite ACL Access

[nelson_08]

Hi Team,

I'm facing an issue with visibility of the admin role record in the sys_user_role table and would appreciate any guidance.

User Account Information

I am testing with a local ServiceNow user that has the following roles:

• snc_internal
• itil
• report_user

Problem

When the user navigates to the sys_user_role list, they receive the following message:

"Number of rows removed from this list by Security constraints: 1"

The missing record appears to be the admin role.

Expected Behavior

I would like this user to be able to view the admin role record in the Roles list (read-only access is sufficient).

Troubleshooting Performed

1. Debug Security Rules

• Impersonated the user and enabled Debug Security Rules.
• Accessed the sys_user_role table.
• Interestingly, the admin role record was visible while debugging.
• After disabling debugging and accessing the list again as the same user, the admin record was no longer visible.

2. Custom Read ACL

• Created a custom role.
• Added a Read ACL on sys_user_role.
• Assigned the custom role to the user.
• The issue persisted.

3. Access Analyzer

• Used Access Analyzer on the specific admin role record.
• The analysis indicates that the user passes the Read operation and has access to the record.

Question

Has anyone encountered this behavior before?

Are there any out-of-box security constraints, query business rules, data filtration mechanisms, before-query rules, or platform-level restrictions that specifically prevent non-admin users from viewing the admin role record, even when ACL evaluation indicates read access is granted?

Any suggestions on additional areas to investigate would be greatly appreciated.

Thanks in advance!

#AccessControlList #ACL