---
sourceDocument: Brazil Build or modify applications
sourceDocumentLink: https://www.servicenow.com/docs/r/application-development

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Build or modify applications

ft:clusterId :

    - cadev

bundleId :

    - cadev

workflow :

    - Development, Data, and Analytics


---

# Explore

# Exploring Application Runtime Policy {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read  
Application Runtime Policy (ARP) is an opt-in zero-trust security framework for custom applications that tracks and enforces fine-grained controls over what resources an application can access at runtime.

## Application Runtime Policy (ARP) overview {#exploring-app-runtime-policy__cf-exploring-parent-overview}

Application Runtime Policy (ARP) is an opt-in, zero-trust security framework for custom app creation and runtime. It enforces fine-grained controls over scripting, record, platform, and cross-scope or cross-origin network resources.

When ARP is activated for an application in development, network and cross-scope access policies are automatically tracked and recorded in the application's policy metadata as you develop application functions. The generated
policies can be automatically approved or can require review and manual approval, depending on how ARP is configured for the application.

Activating ARP also generates one default quota configurations record for the application in development.

## ARP users {#exploring-app-runtime-policy__cf-exploring-parent-users}

{#exploring-app-runtime-policy__table_c3t_vkp_njc__entry__2}

| User | Description |
|-|-|
| Custom application developers | Developers who build custom applications on the ServiceNow AI Platform. They opt in to ARP during development to define and review the resource access policies their application requires before making the application available to other instances in their organization. |
| ServiceNow Store partner developers | Partner developers who develop and publish applications to the ServiceNow Store. ARP gives ServiceNow Store partners a structured way to declare and certify their application's runtime resource access, which reduces the time required for certification review. |
[Table 1. Users]

{#exploring-app-runtime-policy__table_c3t_vkp_njc}

## ARP workflow {#exploring-app-runtime-policy__cf-exploring-parent-workflow}

The following steps describe the end-to-end ARP workflow from application development to installation on a different ServiceNow AI Platform instance.  
1. Opt in to ARP at development time from the custom application \[sys_app\] form by setting the Application Runtime Policy field to Tracking or Enforcing.
2. As you develop application functionality, ARP tracks client and server-side cross origin network requests and automatically creates policy records in the application's metadata.
   * In Tracking mode, policies automatically have the Allowed status.
   * In Enforcing mode, policies are created with a status of Requested and the access is blocked until you approve the policy.
   * The first instance of each violation is recorded in the Runtime Policy Violation Log, regardless of whether ARP is activated in Tracking or Enforcing mode.
3. If using the Enforcing mode, review each policy record and sets its status to Allowed to allow access, or Denied to block it.
4. When the application is ready for publication, the approved policies are packaged and published with the application to your organization's Application Repository or to the ServiceNow Store.

   For more information about publishing to the Application Repository, see [Publish an application to the application repository](https://www.servicenow.com/docs/c9mK1cg0BC14nj4jL4KQpA "Publish a custom application to the application repository so that it can be installed on other instances in your organization."). For more information about publishing an application to the ServiceNow Store, see [Publish an application to the ServiceNow Store](https://www.servicenow.com/docs/e5UpMZ0t40sFf_lhf5pdCQ "Publishing an application to the ServiceNow Store makes it available to everyone.").

   If you publish to the ServiceNow Store, the Runtime Policy summary displays the information that will be included on the application's listing details.
5. When the application is installed to a new instance, ARP enforces policies that are configured to permit access. Undeclared cross-origin and cross-scope access is rejected and logged.  
   Note:  
   After an application built with ARP is installed, its cross-scope privileges can be modified and the update can be published to the Application Repository as an application customization. For more information about modifications to cross-scope privileges, see [Cross-scope privilege record](https://www.servicenow.com/docs/Bs6r_j6wAHY3lrO1t6ALaA "Runtime access tracking uses cross-scope privilege records to determine which script operations and targets the system allows to run."). For more information about customizing applications, see [Manage customizations to applications](https://www.servicenow.com/docs/bVdc4uM6y3Vf8LVJcz9drg "You can manage your company's customizations for applications that belong to other organizations or a scoped ServiceNow plug-in.").
{#exploring-app-runtime-policy__cf-exploring-parent-workflow-ol}

## ARP benefits {#exploring-app-runtime-policy__cf-exploring-parent-benefits}

{#exploring-app-runtime-policy__table_f3t_vkp_njc__entry__3}

| Benefit | Feature | Users |
|-|-|-|
| Limits each application to its own scope by default, so unintended access to external hosts or other application APIs must be explicitly declared and approved. | [Network policies](https://www.servicenow.com/docs/ZeyYfsdPe_Od7JNYY_fkLQ "Review automatically created network policy records and change their status as needed based on intended application behavior."), [Cross-Scope Privilege](https://www.servicenow.com/docs/IPjoBmXek5eH912ApfltQw "Review automatically created cross-scope privilege policy records and change their status as needed based on intended application behavior.") | Custom application developers, ServiceNow Store partner developers |
| Automatically creates and approves policies in Tracking mode, so developers can build out application functionality without stopping to manually configure each access requirement. | [Tracking mode](https://www.servicenow.com/docs/uaA0kXety5X1z~GXG47s8Q "Enable Application Runtime Policy for an application that's in development by setting the policy mode on the custom application form.") | Custom application developers, ServiceNow Store partner developers |
| Prevents a single application from consuming excessive instance resources by defining quota limits for API transactions, UI transactions, and scheduled jobs. | [Quota configurations](https://www.servicenow.com/docs/k68Yc8~jdlWr2DTQOEqGfA "Quota configurations define limits on the resources that an application can use at runtime. Application Runtime Policy uses these limits to prevent a single application from consuming excessive platform resources.") | Custom application developers, ServiceNow Store partner developers |
| Reduces the overhead of granular policy creation by letting developers define broad access patterns for an entire pillar using a single segment policy record. | [Segment policies](https://www.servicenow.com/docs/uiOreGUMxF555rbLXrj~Hw "Create a segment policy to enable broad access to one or more policy categories without requiring individual policy records for each access attempt.") | Custom application developers, ServiceNow Store partner developers |
| Enables automatic ServiceNow Store certification by conforming to variable runtime guarantees about application behavior on ServiceNow AI Platform instances | ARP policy enforcement | ServiceNow Store partner developers |
| Provides application-level cross-scope and cross-origin access information to potential customers before they obtain or install the application, improving transparency. | [ServiceNow Store application listing details](https://www.servicenow.com/docs/access?context=store-listing-details&version=brazil&pubname=brazil-platform-administration&ft:locale=en-US), [Application Manager application details](https://www.servicenow.com/docs/access?context=app-details-app-mgr&version=brazil&pubname=brazil-platform-administration&ft:locale=en-US) | ServiceNow AI Platform administrators |
[Table 2. ARP benefits]

{#exploring-app-runtime-policy__table_f3t_vkp_njc}

## What to explore next {#exploring-app-runtime-policy__cf-exploring-parent-links}

To learn more about configuring and using Application Runtime Policy, see:

* [Configuring Application Runtime Policy](https://www.servicenow.com/docs/A0mszriRBWktE~c5zZqDSQ "Configure Application Runtime Policy to automatically approve generated policies, or to require review and manual approval.")
* [Using Application Runtime Policy](https://www.servicenow.com/docs/eodudzl50olhhVRr4UhqLQ "Application Runtime Policy (ARP) generates policies to control what external resources and cross-scope privileges an application can access at runtime. After opting in, manage policy records, configure resource quotas, and monitor access attempts during development.")
* [Application Runtime Policy reference](https://www.servicenow.com/docs/1UhTUl8F7UHnhv3paNk9rg "Reference topics provide additional information about forms and options available through Application Runtime Policy.")
{#exploring-app-runtime-policy__ul_g3t_vkp_njc}