How to Segregate Access to the New Financials Using Roles

Luis Ataide · Friday

DISCLAIMER: This article describes how to use ServiceNow roles to control access to the new Financials functionality in Strategic Planning Workspace (SPW). The key change requires removing sn_align_ws.spw_funding_user from the portfolio_manager role before applying this configuration. No out-of-the-box role separation is provided — this must be configured by your implementation team.

What problem does this solve?

The new Financials functionality in Strategic Planning Workspace (SPW) introduces budget allocation, scenario approval, and financials capabilities. By default, the sn_align_ws.spw_funding_user role is included in the portfolio_manager role, which means all portfolio managers automatically receive budget allocation access — even when that level of access is not appropriate for all users.

This guide explains how to decouple those permissions and define two distinct user profiles so that access to financial capabilities can be granted based on each user's specific responsibilities.

Roles Reference

The following roles control access to Financials capabilities in SPW. Assign them individually based on each user's responsibilities.

Role	Description
`sn_align_ws.spw_funding_user`	Provides access to budget allocation in the Financials page. Previously included in the `portfolio_manager` role — must be removed as part of this configuration.
`sn_align_core.apw_user`	Provides access to Portfolio/Strategic Planning Workspace.
`sn_align_ws.scenario_approver`	Provides access to approve scenarios in portfolio plan.
`sn_align_ws.spw_financial_user`	Provides access to create cost plans and expense lines for planning items.

Configuration Steps

Step 1: Remove Role from portfolio_manager

Remove the sn_align_ws.spw_funding_user role from the portfolio_manager role. This decouples budget allocation access from the default portfolio manager permissions, enabling granular control over who can allocate budget.

Important: This step must be completed before assigning roles to users. Skipping it will result in all portfolio managers retaining budget allocation access regardless of the role assignments in Step 2.

Role to remove:

sn_align_ws.spw_funding_user → Remove from: portfolio_manager

Step 2: Assign Roles to Users

Assign the appropriate role combination based on each user's function. Two profiles are defined below.

2.1 Financials User

This user can view and work within the Financials tab in Portfolio Plan, but cannot approve scenarios or allocate budget on item (demand, project, epic) financials.

Required roles:

it_portfolio_manager
sn_align_core.apw_user
sn_align_ws.spw_financial_user

Capability	Access
Financials Tab in Portfolio Plan	✔ Yes
Approve Scenarios	✘ No
Allocate Budget in Financials at the item level	✘ No

2.2 Budget Allocation User

This user can view the Financials tab, approve scenarios, and allocate budget within item (demand, project, epic) financials.

Required roles:

it_portfolio_manager
sn_align_ws.spw_funding_user
sn_align_ws.scenario_approver

Capability	Access
Financials Tab in Portfolio Plan	✔ Yes
Approve Scenarios	✔ Yes
Allocate Budget in item Financials	✔ Yes

Capability Comparison

The table below summarizes which capabilities are available to each user type after applying the role configuration above.

Capability	Financials User	Budget Allocation User
Financials Tab in Portfolio Plan	✔ Yes	✔ Yes
Approve Scenarios	✘ No	✔ Yes
Allocate Budget in item Financials	✘ No	✔ Yes

Key Considerations

Always remove sn_align_ws.spw_funding_user from portfolio_manager before assigning user profiles — failure to do so will grant all portfolio managers budget allocation access regardless of individual role assignments.
Test the configuration on a development instance using both user profiles before applying to production.
Verify that removing sn_align_ws.spw_funding_user from portfolio_manager does not break existing workflows in your instance.