Hello,
In an out-of-the-box instance, an ITIL user who has access to the sys_user table does not have access to the customer_contact table by default. The same applies to the customer_contact fields, as read access is not granted by default in an OOTB instance.
I believe this is related to the way ServiceNow evaluates ACLs. If specific Access Control Lists (ACLs) exist for both a child table (customer_contact) and its parent table (sys_user), the system evaluates the most specific rule first, rather than relying on the parent table ACL. As a result, a customer_contact ACL acts as an explicit override, requiring users to satisfy its specific criteria even if they already have access to the broader sys_user table.
Could you please confirm whether my understanding is correct?
If the behavior described above is correct, could you also share the available options to allow ITIL users who already have access to sys_user to access the customer_contact table without modifying the existing out-of-the-box configuration (for example, without changing the customer_contact ACLs)?
Thank you in advance for your help.
