question In which order roles gets evaluation to give real permission in ServiceNow AI Platform forum

In which order roles gets evaluation to give real permission

wakespirit — Fri, 09 Nov 2018 08:00:30 GMT

Dear all,

I am new to service now and practicing using sefl pack lab and one point I am confuse and hard to follow is that based on roles.

i have understand that you can apply ACL to fields and rows for data but also to users.

When all the roles are cascading each other, in which order they are evaluated ?

is tehre a good exemple to understand this ?

Thanks for help

regards

Re: In which order roles gets evaluation to give real permission

Ahmmed Ali — Fri, 09 Nov 2018 08:29:49 GMT

What do you mean by "When all the roles are cascading each other" ?

details would be helpful to suggest/answer on the query.

Thanks,

Ali

Re: In which order roles gets evaluation to give real permission

Jeff Currier — Fri, 09 Nov 2018 18:35:51 GMT

This is the execution order:

The condition must evaluate to true.
The script must evaluate to true or return an answer variable with the value of true.
The user must have one of the roles in the required roles list. If the list is empty, this condition evaluates to true.
[Record ACL rules only] The matching table-level and field-level ACL rules must both evaluate to true.

The sequence is ROLES first, then condition, then script. Roles are cached so it's always more efficient to use roles whenever possible. Any role that matches will be OK. Doesn't matter which is first.

Re: In which order roles gets evaluation to give real permission

nareshbh — Thu, 05 Dec 2019 05:41:51 GMT

The sequence is ROLES first, then condition, then script. Roles are cached so it's always more efficient to use roles whenever possible.

Docs: Access control rules

Docs: Contextual security

Security Best Practices - ServiceNow Wiki