How are Multiple ACL Rules at the Same Point in the Processing Order evaluated?

[Heiko Bllr]

Below is what is stated in the Wiki. I find it contradicting.

....

If ServiceNow matches two or more rules at the same point in the processing order, the user must pass any one of the ACL rules permissions in order to access the object. For example, if you create two field ACL rules for incident.number, then a user who passes one rule has access to the number field regardless of whether the user failed any other field ACL rule at the same point in the processing order.

...

"....the user must pass any one of the ACL...." (does any one mean ALL ?)

"....a user who passes one rule has access to the number field regardless of whether the user failed any other field ACL rule at the same point in the processing order..."

So which of the above two statements is true? Do both rules have to return TRUE or just one of them? I would assume that all rules have to return TRUE.

Thanks,

Heiko

[acretion · Accepted solution]

Just one would need to return true if they are both incident.number field ACLs

On the other hand, If you had one incident.number field ACL and one incident table level ACL (no dot anything) then both need to be true

[faisal_dadabhoy]

I believe Christopher is right, just one ACL needs to true to grant access (but not sure)

For that ACL it will evaluate Role, Condition and Script to grant access.

Thanks, Faisal

[Heiko Bllr]

Thanks Christopher for your quick response.

Heiko

[amol_joshi]

I have 5 "table-none" READ ACLs on table sn_grc_issue. They have different roles in them but which one actually works in the end?

2 of these 5 have same role "sn_grc.business_user" along with some other roles. So what's the resultant here?

Thanks