Access Control Lists (ACLs)

[SUHEL AKTHER Md]

I am new here!
Can anyone explain about the Access Control Lists (ACLs) and its types.

[Dr Atul G- LNG]

Hi @SUHEL AKTHER Md 

https://youtu.be/oaOUD3dNFe4

https://www.servicenow.com/community/itsm-articles/access-control-lists-in-servicenow/ta-p/2304210#:....

https://www.servicenow.com/community/now-platform-forum/understanding-servicenow-acl-a-guide-for-adm...

[Anand Kumar P]

Hi @SUHEL AKTHER Md ,

ACL(Access Control List):

An instance uses access control list (ACL) rules, also called access control rules, to control what data users can access and how they can access it.(Simple meaning perform restriction of data) ACL rules require users to pass a set of requirements in order to gain access to particular data.

ACL rules can secure the following record operations:

I m Defining  only for 4 Operation With Example:

Read    :     Allows users to display records from a table.

Write    :     Allows users to update records in a table.

Create :     Allows users to insert new records (rows) into a table.

Delete :    Allows users to remove records from a table or drop a table.

Security Admin: This role allows users to create, modify, and manage ACL rules.

Role: security_admin

1. Table-Level ACL (Record ACL):

Controls access to entire tables (e.g., the Incident table).

Operations: Create, Read, Write, Delete, List.

Roles: Users need roles like itil, admin to access the table.

2. Field-Level ACL:

Controls access to specific fields within a table (e.g., assigned_to field in the Incident table).

Operations: Read, Write.

Roles: Users need roles like itil or custom roles for specific fields.

ACL Decision Types:

1. Allow-If: Grants access if conditions are met (e.g., user has the correct role).

2. Deny-Unless: Denies access unless conditions are met (e.g., user role, field conditions).

ACL Conditions:

Role: A user must have a role (e.g., itil, admin) to access the object.

Condition Script: Custom scripts can be used to check specific conditions.

Data Condition: E.g., allow access only to active incidents (incident.state != "Closed").

How ACL Works:

Role Check: The user must have the required role listed in the ACL.

Condition Check: The record or field must meet the defined condition (e.g., incident state must be “Active”).

Script Check: If there’s a script, it must evaluate to true for access.

https://www.servicenow.com/docs/bundle/xanadu-platform-security/page/administer/contextual-security/...

https://www.servicenow.com/community/itsm-articles/access-control-lists-in-servicenow/ta-p/2304210

If my response helped, please mark it as the accepted solution ✅ and give a thumbs up👍.
Thanks,
Anand

[Juhi Poddar · Accepted solution]

Hello @SUHEL AKTHER Md 

"Welcome to the community!

Access Control Lists (ACLs) in ServiceNow are a powerful way to manage access to data at various levels, ensuring that only authorized users can view or modify information. Understanding ACLs can be a bit overwhelming at first, but don’t worry—there are plenty of resources available to help you get started.

Here are some excellent resources:

1. ServiceNow Docs: ACL Documentation 
2. Community Forums: A treasure trove of practical scenarios and solutions shared by experts.
3. YouTube Tutorials: Below are some great beginner-friendly videos:
   1. How ACL works in ServiceNow
   2. Create different ACL in ServiceNow
   3. ACL control list rules

If you're just getting started, I recommend focusing on understanding the three main types of ACLs:

• Table-level ACLs: Control access to the entire table.
• Field-level ACLs: Restrict access to specific fields within a table.
• Record-level ACLs: Apply conditions to individual records within a table.

Feel free to reach out with specific questions—happy to help further!"

"If you found my answer helpful, please like and mark it as an "accepted solution". It helps others find the solution more easily and supports the community!"

Thank You
Juhi Poddar

[Ankur Bawiskar]

@SUHEL AKTHER Md 

there are lots of articles, blogs and videos about it which you can go through

what do you wish to know?

If my response helped please mark it correct and close the thread so that it benefits future readers.