Best practices for monitoring and restricting SDK / pro-code access for ITIL (nonAdmin) users ?

[Vivek Verma]

Hi Community,

We are starting to use the ServiceNow SDK (`@servicenow/sdk` / now-sdk) for development, primarily in Global scope using Global Applications.

### Current Setup

- Developers authenticate via `now-sdk auth` (browser-based OAuth flow → token pasted into the terminal).
- The session is tied to the authenticated ServiceNow user and respects their roles + ACLs.
- We understand that an ITIL user who sets up the SDK with their own account can query and act on records (e.g. incidents) according to their privileges.

### Concern
We intentionally give ITIL users interactive UI access.
However, we do **not** want them to use pro-code tools (now-sdk / Table API / external IDEs) to perform the same (or broader) actions in a non-interactive way — for example creating dashboards, bulk querying, or other configuration changes that their role technically allows.

### What we already understand
- The SDK runs with the privileges of the authenticated user (no privilege escalation).
- Transaction logs (`syslog_transaction` with `type=rest`) can be used for monitoring.
- Options we are aware of:
- Activating the Table API ACL and removing `snc_platform_rest_api_access` from the ITIL role
- REST API Access Policies (role / group / IP based)
- REST API Auth Scopes and Machine Identity Access Controls
- Tightening table ACLs on sensitive objects

### Questions
1. What is the **recommended** way in current releases to allow ITIL users full interactive UI access while restricting or blocking their ability to use the Table API / now-sdk / external pro-code tools?

2. Are there any known side-effects of removing `snc_platform_rest_api_access` from ITIL (does it break legitimate platform features for those users)?

3. What is the best practical approach for **monitoring** who is using now-sdk or making REST calls from external tools (beyond basic transaction logs)?

4. For Global Application development with the SDK, is creating a dedicated Global Application (with its own Sys ID in `now.config.json`) still the official recommended pattern?

Any real-world experiences, recommended configurations, or official guidance would be highly appreciated.

Thank you!