GRC: Entity Based Access release notes

  • Release version: Store
  • Updated June 11, 2026
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of GRC: Entity Based Access Release Notes

    The GRC: Entity Based Access application in ServiceNow enables organizations to implement fine-grained security by restricting access to entities and their related records based on user roles and group memberships. This release history outlines key updates, new features, and fixes that enhance security, performance, and usability for managing entity-based access controls.

    Show full answer Show less

    Key Features and Enhancements

    • Audit Workspace Security Enhancements (Version 22.3.1): Audit-relevant configuration records are now visible only to users with the Third Line Manager role when Audit Workspace is installed. This restricts access to sensitive audit configurations and strengthens security.
    • Platform-wide Row-Level Query Security (Version 22.3.1): All Entity-Based Access tables enforce platform-managed row-level query restrictions, ensuring users see only authorized data in lists, reports, and REST queries. This improves both security and system performance.
    • Preservation of Custom Query ACLs (Version 22.3.1): Custom query-level ACLs are preserved during plugin installations and upgrades by deactivating conflicting platform defaults, protecting customer customizations.
    • Improved Access Resolution Performance (Version 22.3.1): Optimizations reduce duplication in database queries when resolving user access to parent records, resulting in faster list loads and access checks without changing access results.
    • Tightened Authorization on Table-Label Lookup (Version 22.3.1): The system now verifies read permissions before displaying table labels for Entity-Based Access reference tables, preventing unauthorized visibility of table names in the UI.
    • Localization Updates (Version 22.3.1): System messages, UI labels, and documentation have been refreshed in 23 languages, enhancing usability for non-English speakers.
    • Record Attributes User Access Control (Version 21.1.4): Ensures users and groups referenced in record fields maintain seamless access even with entity-based access enabled, reducing manual configurations and administrative overhead.
    • Continuous Maintenance of Access Restrictions (Version 21.0.2): Introduced configurations to maintain access restrictions on entities and their related record types, including support for custom tables and CRUD operations on applicable record types.
    • Guided Assistance for Bulk Access Updates (Version 21.0.2): Streamlined the experience for applying entity-based access restrictions via a four-step guided process covering scope definition, related record scoping, condition application, and review before execution.
    • Access Restriction Deactivation Behavior (Version 21.0.2): When entity-based access configurations are deactivated, the system automatically assesses affected records and removes restrictions only if no other configurations apply.
    • Initial Framework for Entity and Downstream Object Security (Version 20.1.4): Allows configuration of access restrictions on entities and related objects, such as limiting Risks and Controls visibility to specific user groups based on entity attributes like location.

    Fixes and Improvements

    • Email notifications upon completion of bulk utility configuration jobs were fixed to notify users of success or failure accurately (Version 22.0.1).
    • Resolved issues where deactivating entity type configurations did not remove associated access restrictions properly (Version 21.1.4).

    Practical Benefits for ServiceNow Customers

    These enhancements enable ServiceNow customers to:

    • Implement robust, scalable entity-based access controls that improve data security and compliance with audit requirements.
    • Maintain existing custom security configurations without disruption during upgrades.
    • Optimize performance and usability when managing access restrictions across complex entity relationships.
    • Leverage improved localization for global teams.
    • Reduce administrative effort through guided tools and seamless user access control mechanisms.

    Version history for the GRC: Entity Based Access application on the ServiceNow Store.

    Important:
    For details on system requirements and family compatibility, view the application listing on the ServiceNow Store website.

    Version history

    Version 22.3.1 - June 2026 (Australia)
    • This release adds new security restrictions, performance improvements, and localization updates to GRC Entity-Based Access.
    • Audit Workspace restricts sensitive configurations: Access configuration records flagged as audit-relevant are now visible only to users with the Third Line Manager role when Audit Workspace is installed alongside Entity-Based Access, hiding them from general users to enhance audit security.
    • Row-level query security enforced platform-wide: All Entity-Based Access tables now have platform-managed row-level query restrictions, ensuring that users only see rows they are authorized to access during list views, reports, and REST queries, improving security and performance.
    • Preservation of custom query ACLs: During plugin installation and upgrades, custom query-level ACLs are detected and preserved by deactivating conflicting platform defaults, ensuring that customer customizations remain intact and clearly distinguished from system-supplied ACLs.
    • Improved access resolution performance: The process determining user access to parent records has been optimized to deduplicate matching records within the database, resulting in faster list loads and access checks without changing which records users can see.
    • Tightened authorization on table-label lookup: The internal service that returns display labels for Entity-Based Access reference tables now checks read permissions before providing the label, preventing unauthorized users from seeing table names in the user interface.
    • Localization updates in 23 languages: Translations for system messages, UI labels, and documentation have been refreshed across 23 languages, improving the experience for non-English speakers and ensuring previously missing strings are now translated.
    Version 22.0.1 - March 2026
    Fixed: Emails are sent upon completion of the bulk utility configurations job to notify users of successful changes or failures.
    Version 21.1.4 - December 2025 (Zurich)
    • New: Record Attributes User Access control: Maintain seamless access for users and groups referenced in record fields even though entity-based access is enabled. This avoids manual configurations, reduces administrative overhead, and helps in adopting entity-based access with minimal disruption.
    • Fixed: When Entity type configuration is deactivated, Entity type configuration was not removing the EBA restriction.
    Version 21.0.2 - August 2025
    • New:
      • Continuous maintenance of access restrictions on entity's related record types.
      • Introduced "Entity based data access rules" configuration.
        • Support for enabling Entity-based access on custom tables.
        • Provided entity-based access admin to perform CRUD operations on "Applicable record type" table.
    • Changed:
      • Entity access update utility experience from record page to guided assistance.
      • Apply entity-based access (EBA) restrictions at the record level by using guided assistance in the bulk access update utility.
      • Guided assistance consists of a four-step process:
        • Define the scope for the relevant entities, entity types, or entity classes.
        • Scope the related record types
        • Apply the conditions to each record type to refine the scope
        • Review the selected records before you execute and initiate the update
    • Fixed:
      • Entity-based access configuration deactivation behaviour
      • Deactivate entity-based access configuration, enabling the system to automatically assess the records that it impacts.
      • If only the configuration is restricting a record, the access restrictions are removed.
      • If other configurations also apply to the record, the restrictions remain in place and only the selected configuration is deactivated.
    Version 20.1.4 - May 2025
    • New framework to set up configurations to restrict access on entities and related downstream objects.
    • For example, restrict access to Risks and Controls of specific Locations or Entities to certain User groups or Users.