question Re: Part of the query on sys_choice has been ignored because of insufficient access for 'query_match in ITSM forum

Part of the query on sys_choice has been ignored because of insufficient access for 'query_match'

CharlieNZ — Sun, 18 May 2025 20:29:38 GMT

I hope this is the right place for this.

We have a user that has started getting these on each Incident they view:

Part of the query on sys_choice has been ignored because of insufficient access for 'query_match' operation on sys_choice.name Part of the query on sys_choice has been ignored because of insufficient access for 'query_match' operation on sys_choice.inactive Part of the query on sys_choice has been ignored because of insufficient access for 'query_match' operation on sys_choice.dependent_value Part of the query on sys_choice has been ignored because of insufficient access for 'query_match' operation on sys_choice.element

We haven't made any changes to their account. The issue wasn't there a week ago.

Re: Part of the query on sys_choice has been ignored because of insufficient access for 'query_match

phgdet — Mon, 19 May 2025 03:09:11 GMT

Hi @CharlieNZ,
There is an article that has quite the same error message you got. Maybe you need to update this property.

Name: glide.db.encoded_query.field_acl_error_msg

Type: true | false

Value: false

Re: Part of the query on sys_choice has been ignored because of insufficient access for 'query_match

Robert H — Mon, 19 May 2025 06:07:45 GMT

Hello @CharlieNZ ,

Please check the ACLs on your instance. "query_match" is a new type of ACL that allows fine tuning what kind of queries users can perform.

Based on the error message you seem to have such an ACL configured for the sys_choice table. So you would have to review the roles/conditions/scripts in that ACL to find out why that particular does not get matched by that ACL, and then either adjust the user's roles, or the ACL, or create an additional ACL with criteria that would let that user pass.

More details here.

Regards,

Robert

Re: Part of the query on sys_choice has been ignored because of insufficient access for 'query_match

SumanthDosapati — Mon, 19 May 2025 06:11:16 GMT

@CharlieNZ

Create the following system property to prevent the errors from popping up:
Name: glide.db.encoded_query.field_acl_error_msg
Type: true | false
Value: false

Accept the solution and mark as helpful if it does, to benefit future readers.
Regards,
Sumanth

Re: Part of the query on sys_choice has been ignored because of insufficient access for 'query_match

Konrad Mlodzik — Mon, 19 May 2025 11:56:51 GMT

I have same issue and for now found out that the only query_match ACL which I have in my instance is *.*

It should give access to the query_match operations to if user have READ rights on table/record but in my case users have READ access on sys_choice but still this error shows up and mess with few custom fields in incident form.

I'm investigating that with a team further and if we'll find anything I'll post update here

Re: Part of the query on sys_choice has been ignored because of insufficient access for 'query_match

CharlieNZ — Mon, 19 May 2025 21:25:20 GMT

Thanks, this has hidden the messages.

Re: Part of the query on sys_choice has been ignored because of insufficient access for 'query_match

CharlieNZ — Mon, 19 May 2025 21:36:15 GMT

When I look under ACL for query_match Operations, there is one listed:

Looking at the sys_choice table, there are no query_match operations listed.

Re: Part of the query on sys_choice has been ignored because of insufficient access for 'query_match

CharlieNZ — Mon, 19 May 2025 21:37:59 GMT

Thanks, I have hidden the messages for now using the System Property glide.db.encoded_query.field_acl_error_msg

Re: Part of the query on sys_choice has been ignored because of insufficient access for 'query_match

Robert H — Tue, 20 May 2025 04:47:19 GMT

Hello @CharlieNZ ,

Thanks for the update. If you only have the *.* query_match ACL then it means the access is granted depending on whether the user has read access to the fields involved in the query.

So please check if you have any of the following ACLs for the read operation:

sys_choice.*
sys_choice.name
sys_choice.inactive
sys_choice.dependent_value
sys_choice.element

Most probably your affected user does not have any of the roles required by those ACLs, so you would either have to grant them one of these roles, or create a new sys_choice.* read ACL that lets the user pass.

Please note that updating the glide.db.encoded_query.field_acl_error_msg System Property will only hide the error message, it does not fix the user's access issue.

Regards,

Robert

Re: Part of the query on sys_choice has been ignored because of insufficient access for 'query_match

SumanthDosapati — Tue, 20 May 2025 05:08:04 GMT

@CharlieNZ

Did the above solution work? If yes, Accept the solution and mark as helpful to close the thread and benefit other readers.

Regards,
Sumanth

Re: Part of the query on sys_choice has been ignored because of insufficient access for 'query_match

Konrad Mlodzik — Tue, 20 May 2025 08:39:34 GMT

Hello @CharlieNZ
My investigation shown that in fact, users didn't have read access to the field specified in the error message, visible in the below screenshot. All of that due to all sys_choice.* ACLs.

My approach from here was to create sys_choice ACL for each of the fields that were prompted in error message, so in my case sys_choice.element and sys_choice.dependent_value.
I made them similar to the existing read ACL sys_choice.label.
Here you have an overview how I created that ACL:

And as you can see here now in Access Analyzer, access is evaluated to true

Try this approach with at least one of the fields from sys_choice that you have mentioned in yours error messages and see if the error still occurs. For me that works

If you can please mark that as helpful and that resolved your issue so that can help other visiting this thread 🙂

Re: Part of the query on sys_choice has been ignored because of insufficient access for 'query_match

CharlieNZ — Tue, 20 May 2025 19:42:53 GMT

Thanks,

This worked for me

Re: Part of the query on sys_choice has been ignored because of insufficient access for 'query_match

Konrad Mlodzik — Wed, 21 May 2025 09:57:58 GMT

Superb!
I'm glad that I could help

Re: Part of the query on sys_choice has been ignored because of insufficient access for 'query_match

Karla Chorny — Mon, 22 Sep 2025 20:23:00 GMT

In my experience, this will eliminate the error messages, but the user still won't be able to filter the fields that were erroring before.

Re: Part of the query on sys_choice has been ignored because of insufficient access for 'query_match

Konrad Mlodzik — Mon, 22 Sep 2025 20:31:34 GMT

Hello Karla!

Did you maybe tried the solution I proposed? I think after that user should be able to filter the fields.

Re: Part of the query on sys_choice has been ignored because of insufficient access for 'query_match

Karla Chorny — Mon, 22 Sep 2025 20:57:05 GMT

I added a query_match and a query_range ACL for .* on the table I was having trouble with and deactivated all of the field level query_match ACLs for the same table. That resolved the issue for me.

Re: Part of the query on sys_choice has been ignored because of insufficient access for 'query_match

Craig Tinsley — Fri, 09 Jan 2026 14:41:52 GMT

FWIW: we ran into this when we migrated from classic ServiceNow Dashboards/Reports to Platform Analytics Dashboards/Data Visualizations - specifically for the "sys_portal_preferences.portal_section". I initially used the glide record solution posted earlier in this thread; however, that didn't settle well with me, as this was simply masking the problem. I contacted our Governance partners at ServiceNow, and their recommendation was to address the ACL in the manner shown above. While either solution "will" work, the "more appropriate" action would be to address the specific ACL(s) at the source. Good comments - thanks to all!