---
sourceDocument: Xanadu ServiceNow AI Platform Capabilities
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/servicenow-platform

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu ServiceNow AI Platform Capabilities

ft:clusterId :

    - platcap

bundleId :

    - platcap

workflow :

    - Platform


---

# Restrict access

# Restrict access {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Service Catalog enables an
administrator to grant or deny access to a service catalog item or category by company,
department, group, user, or location.

## Before you begin

Role required: admin

## Procedure

1. Navigate to AllService CatalogMaintain Items or Service CatalogMaintain Categories.
2. Open the relevant catalog item or category.
3. [Configure the
   form](https://www.servicenow.com/docs/access?context=configure-form-layout&version=xanadu&pubname=xanadu-platform-administration&section=t_ConfigureAForm&ft:locale=en-US) to add the appropriate Available or Not available lists.  
   Figure 1. Access Control
4. Add the companies, departments, groups, users, or locations to the appropriate list.
5. Click Update.

## Restrict access by role {#ariaid-title2}

By default, individual catalog items and categories do not have access
restrictions.

### Before you begin

Role required: admin

### About this task

Administrators can grant or deny access to a service catalog item or category based
on role.

### Procedure

1. Navigate to AllService CatalogMaintain Items or Service CatalogMaintain Categories.
2. Open the relevant catalog item or category.
3. Add the required roles to the Roles field.  
   You can, if needed, [Configure the
   form](https://www.servicenow.com/docs/access?context=configure-form-layout&version=xanadu&pubname=xanadu-platform-administration&ft:locale=en-US) or change to Default View to see the Roles field.Figure 2. Roles Granted

## Restrict access by a script {#ariaid-title3}

Service Catalog enables you to
control access to a service catalog item or category with a custom script.

### Before you begin

Role required: admin

### Procedure

1. Navigate to AllService CatalogMaintain Items or Service CatalogMaintain Categories.
2. Open the relevant catalog item or category.
3. [Configure the
   form](https://www.servicenow.com/docs/access?context=configure-form-layout&version=xanadu&pubname=xanadu-platform-administration&ft:locale=en-US) to add the Entitlement Script field.  
   Figure 3. Entitlement Script
4. In the Entitlement Script field, enter the access control script.  
   Sample Scripts:  
   The following example script grants access to a catalog item named French Blackberry to users with a language of Fr (French):

       gs.log ( 'Running Entitlement script for French Blackberry' ) ;
        
        if (gs. getUser ( ). getLanguage ( ) == 'fr' ) 
           answer = true ; else 
           answer = false ;
        
       answer ;

   The following example script could be used to distinguish between two categories of users (one with full access and one with restricted access) on the catalog of services:

       var userid  = gs. getUserID ( ) ; var now_GR  = new GlideRecord ( 'sys_user' ) ; 
       now_GR. get ( 'sys_id' , userid ) ; 
        
        if (now_GR. source )
           answer = true ; else
           answer = false ; 
        
       answer ;

   Overriding Entitlement Scripts by Role
   1. Navigate to Service CatalogProperties.
   2. Enter the roles for which to override the entitlement script (grant access) in the property List of roles (comma-separated) that can override normal entitlement checking inside the catalog. An itil role of "itil" means that the itil role can order any catalog item, even one protected by entitlement restrictions.
   {#t_ControllingAccessWithAScript__ol_ey5_qyn_dp}

*[\>]: and then