ACLs

Hello Everyone,

I have a query regarding ACL behavior in ServiceNow.

I created a custom table and configured field-level ACLs. I granted access to a specific custom role and assigned that role to a custom user. When I impersonate that user, everything works as expected — the user can see the table and its fields properly.

However, when I impersonate another user who does not have the custom role, the table access is denied (as expected). But surprisingly, the user can still see the form layout of the custom table, although no fields are visible.

My question is:

If the user does not have the required role and table access is denied, why is the table form still visible (without fields)?
Is this expected behavior? Do I need to create a table-level ACL explicitly to prevent the form from being displayed?