---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Deny-Unless ACL

# Deny-Unless ACL {#ariaid-title1}

Release version: Brazil  
Updated October 27, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
A Deny-Unless ACL grants access only when a user meets all defined role, condition, and script requirements. If any requirement is unmet, access is denied.
Deny-Unless ACLs are evaluated with a "deny-unless" approach. The ACL defines the users that aren't denied. Said another way, the user is denied access unless the role, condition, and script requirements are met.  
Warning:  
Deny-Unless ACLs take priority over Allow-If ACLs in ACL evaluation and are evaluated first.  
A Deny-Unless ACL produces two outcomes.{#acl-denial-behavior__table_jnn_5pl_zbc__entry__2}

| Evaluation outcome | Result |
|-|-|
| Pass | The defined roles, data conditions, security attributes, and script requirements are met. The ACL proceeds to further evaluation. Warning: Even if a Deny-Unless ACL matches, access is only granted when an Allow-If ACL explicitly permits it. If no Allow-If ACL is matched and the Deny-Unless ACL passes, the system grants access by default. |
| Fail | The Deny-Unless ACL is marked as failing and access will be denied. |
[ ]

{#acl-denial-behavior__table_jnn_5pl_zbc}  
The following is an example of a Deny-Unless ACL:

* ACL has roles sn_hr_core.manager or itil
* Condition has active = true
* script has answer = gs.isLoggedIn();
{#acl-denial-behavior__ul_t3l_tql_zbc}The user is denied access unless all three requirements for this ACL are satisfied. For this Deny-Unless ACL to pass, a user must have the sn_hr_core.manager or itil role, be accessing an active record, and be logged in. The Deny-Unless ACL fails if any of the three requirements is not met.

If there are multiple Deny-Unless ACLs on a specific resource, none of them must deny access during evaluation.