---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Query ACLs

# Query ACLs {#ariaid-title1}

Release version: Brazil  
Updated October 27, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Query ACLs enable more granular access control by defining who can query the data.

## What is a query ACL {#query-acl-rule__section_ctb_1yl_zbc}

A query ACL is a record-type ACL that has its operation set to either
`query_range` or `query_match`. Query ACLs allow for more specific control of user queries, restricting or enabling
access based on their setup. Query ACLs restrict who can query the data, preventing attackers from extracting
information from query results even when they can't see the values.

## When to use a query ACL {#query-acl-rule__section_pn2_yf5_pcc}

Wherever a column contains sensitive values, and allows partial or conditional access to data, a query ACL should be considered and implemented as necessary based on the sensitivity of the
data.
Wherever there is a partial/conditional access to rows and their columns in tables, especially where that access is not enforced by data filters, query ACLs should be implemented as necessary based on the sensitivity of the data.  
Note:  
Consider query ACLs when some users have access to some rows or columns and not others.  

## Payroll query control {#query-acl-rule__example_ngj_rh5_pcc}

A user can see one row in the payroll table for their own salary, but has no reason to issue range queries for users with a salary within two boundaries. A `query_range` ACL on salary would prevent them from issuing that query.  

## HR query control {#query-acl-rule__example_p1g_vh5_pcc}

A user can see all hr_profiles, but can only see their own SSN. Query ACLs prevent users from running queries against the SSN of other hr profiles to extract SSN mappings.

## Query ACL behavior {#query-acl-rule__section_xbm_dg5_pcc}

Query ACLs use `query_match` and `query_range` operations for secure and granular table querying behavior. Their behaviors are described below:

`query_match`

:   `query_match` is composed of: EQUALS, NOT_EQUALS, IN, NOT_IN, SAMEAS, NSAMEAS, ANYTHING, ISEMPTYSTRING, ISEMPTY, ISNOTEMPTY, ISNULL, ISNOTNULL. `query_match` is made of the "safe operators", in a
    sense that they are built to fetch specific record(s), and can't be exploited to return others.

    {#query-acl-rule__table_c3k_1zl_zbc__entry__2}

    | Evaluation outcome | Result |
    |-|-|
    | Pass | User can submit match queries |
    | Fail | Users can't submit match queries: * EQUALS * NOT_EQUALS * IN * NOT_IN * SAMEAS * NSAMEAS * ANYTHING * ISEMPTYSTRING * ISEMPTY * ISNOTEMPTY * ISNULL * ISNOTNULL {#query-acl-rule__ul_un1_335_pcc} |
    [ ]

    {#query-acl-rule__table_c3k_1zl_zbc}

`query_range`

:   `query_range` is composed of all the others (STARTS_WITH, CONTAINS, \>=, \<=, and similar
    operators) which are more dangerous as they allow users to query for more records by adjusting the boundary values.

    {#query-acl-rule__table_jnn_5pl_zbc__entry__2}

    | Evaluation outcome | Result |
    |-|-|
    | Pass | User can submit range queries and sorting is unrestricted |
    | Fail | Users cannot submit range queries with STARTS_WITH, CONTAINS, \>=, \<=, and similar operators. Sorting by column is restricted. |
    [ ]

{#query-acl-rule__table_jnn_5pl_zbc}  
Warning:  
Query ACLs (both query_match and query_range) default to a star.star ACL that delegates to read access. This means, where ACLs are enforced on queries, if no query ACL was created then read access to the column is evaluated ; if
query ACLs are defined then they override the default behavior.