Decision Types in ACLs

Hi everyone,

I’m working with ACLs on a custom table and noticed unexpected behavior when switching the Decision Type.

• When I configure the ACL with Decision Type = "Allow if", it works correctly based on the condition I’ve defined.

• However, when I change the Decision Type to "Deny Unless" using the same condition, it does not behave as expected.

My requirement is to restrict write access based on a specific condition (e.g., allowing edits only when a field contains certain values and for users with a specific role).

I would like to understand:

• Why does the ACL work with "Allow if" but not with "Deny Unless"?

• Are there differences in how ServiceNow evaluates these decision types in combination with other ACLs (like table-level or wildcard ACLs)?

• What is the recommended approach to implement such conditional access properly?

• Here I am attaching the images of that what I have given

Any insights or best practices would be greatly appreciated.

Thanks in advance!