Deny-Unless ACL

Release version: Brazil
Updated October 27, 2026
1 minute to read

A Deny-Unless ACL grants access only when a user meets all defined role, condition, and script requirements. If any requirement is unmet, access is denied.

Deny-Unless ACLs are evaluated with a "deny-unless" approach. The ACL defines the users that aren't denied. Said another way, the user is denied access unless the role, condition, and script requirements are met.

Warning:
Deny-Unless ACLs take priority over Allow-If ACLs in ACL evaluation and are evaluated first.
A Deny-Unless ACL produces two outcomes.
Evaluation outcome Result
Pass The defined roles, data conditions, security attributes, and script requirements are met. The ACL proceeds to further evaluation.
Warning:
Even if a Deny-Unless ACL matches, access is only granted when an Allow-If ACL explicitly permits it. If no Allow-If ACL is matched and the Deny-Unless ACL passes, the system grants access by default.
Fail The Deny-Unless ACL is marked as failing and access will be denied.
The following is an example of a Deny-Unless ACL:
  • ACL has roles sn_hr_core.manager or itil
  • Condition has active = true
  • script has answer = gs.isLoggedIn();
The user is denied access unless all three requirements for this ACL are satisfied. For this Deny-Unless ACL to pass, a user must have the sn_hr_core.manager or itil role, be accessing an active record, and be logged in. The Deny-Unless ACL fails if any of the three requirements is not met.

If there are multiple Deny-Unless ACLs on a specific resource, none of them must deny access during evaluation.