---
sourceDocument: Brazil Build or modify applications
sourceDocumentLink: https://www.servicenow.com/docs/r/application-development

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Build or modify applications

ft:clusterId :

    - cadev

bundleId :

    - cadev

workflow :

    - Development, Data, and Analytics


---

# Review cross-scope privilege policies

# Review cross-scope privilege policies {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Review automatically created cross-scope privilege policy records and change their status as needed based on intended application behavior.

## Before you begin

* For cross-scope privilege policies to be automatically generated, Application Runtime Policy (ARP) must be enabled in either Tracking or Enforcing mode for the application you're developing.
* If ARP is in Enforcing mode, you must review and approve the generated cross-scope privilege policies before the application can access the specified resource. For more information about Tracking and Enforcing modes, see [Application Runtime Policy modes](https://www.servicenow.com/docs/~rqS1R~GWk7ESpyopuhr~A "When enabled, Application Runtime Policy operates in two possible modes: Tracking and Enforcing. Tracking mode automatically allows out-of-scope access attempts, while Enforcing mode automatically blocks out-of-scope access attempts until you review them.").
{#review-cross-scope-policy-arp__ul_ndw_ygz_vjc}

Role required: arp_admin or admin.

## About this task

Note:  
All policy records generated by ARP must be in the Allowed or Denied state before publishing to the Application Repository or the ServiceNow Store. Policies left in the Requested state block publication.

## Procedure

1. Navigate to AllSystem PolicyApplication Runtime PolicyCross Scope Privilege.
2. From the list, locate a policy record with the Requested status and review the policy details.  
   Policies with the Allowed or Denied status can also be reviewed and changed as needed.
3. Double-click the value in the Status field (or use the keyboard shortcut) to open the drop-down list of status options.
4. Select an option to allow or block resource access as defined in the policy.
   * Select Allowed to enable access.
   * Select Denied to block access.
   {#review-cross-scope-policy-arp__choices_xdd_yvf_wjc}
5. Select the Save (Enter) icon![]() or use the Enter key to save your selection.
6. Repeat for each Requested policy record.

## Result

Cross-scope privilege policies with the Allowed status permit the application to call the specified script or access the specified table in other application scopes. The cross-scope call completes
successfully when the application functionality is next exercised.

Cross-scope privilege policies with the Denied state prevent the application from calling the specified script or accessing the specified table in another application scope. To prevent errors, make sure the
application doesn't continue attempting to access the blocked resource.

## Changing policy status from the table {#review-cross-scope-policy-arp__id_srv_54w_bkc}

*[\>]: and then