In which order roles gets evaluation to give real permission

[wakespirit]

Dear all,

I am new to service now and practicing using sefl pack lab and one point I am confuse and hard to follow is that based on roles.

i have understand that you can apply ACL to fields and rows for data but also to users.

When all the roles are cascading each other, in which order they are evaluated ?

is tehre a good exemple to understand this ?

Thanks for help

regards

[Ahmmed Ali]

What do you mean by "When all the roles are cascading each other" ?

details would be helpful to suggest/answer on the query.

Thanks,

Ali

[Jeff Currier · Accepted solution]

This is the execution order:

• The condition must evaluate to true.
• The script must evaluate to true or return an answer variable with the value of true.
• The user must have one of the roles in the required roles list. If the list is empty, this condition evaluates to true.
• [Record ACL rules only] The matching table-level and field-level ACL rules must both evaluate to true.

The sequence is ROLES first, then condition, then script. Roles are cached so it's always more efficient to use roles whenever possible.  Any role that matches will be OK.  Doesn't matter which is first.

[nareshbh]

The sequence is ROLES first, then condition, then script. Roles are cached so it's always more efficient to use roles whenever possible.

 Docs: Access control rules

Docs: Contextual security  

Security Best Practices - ServiceNow Wiki