Frequently Asked Questions

  • Release version: Australia
  • Updated March 12, 2026
  • 3 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Frequently Asked Questions - Access Analyzer (Australia Release)

    This document addresses common questions ServiceNow customers have when using the Access Analyzer tool, specifically focusing on its key features: Evaluate Access, Compare User Records, and Compare User Access. It helps customers understand how to interpret results, manage roles and groups, and evaluate access control logic to effectively secure their instance.

    Show full answer Show less

    Evaluate Access

    • Reading Evaluation Results: Each row corresponds to an Access Control List (ACL) evaluated in sequence. The status indicates if access was granted (passed) or denied (blocked).
    • ACL Evaluation Process: ACLs at the table level evaluate only roles and security attributes; conditions and scripts are evaluated only if roles pass. Roles are checked first, and if blocked, further checks are skipped.
    • Legends: Key status indicators include Passed (access granted), Blocked (access denied), Skipped (not evaluated), and Undefined (no rule found).
    • Alert Icon: Indicates an ACL contains a script. Customers should review these ACLs for detailed access logic using the Access Analyzer debug logs.
    • IAccessHandler: An internal, non-modifiable system security check that can grant or deny access without evaluating ACLs. For example, it manages read-only access to application resources.
    • Data Filters: Complement ACLs by providing additional access control layers.
    • ACL Rules: Define requirements users must meet to access data. Time-limited role assignments can influence results and should be reviewed when relevant.

    Compare User Records

    • Details Tab: Displays metadata for two compared users.
    • Granting Roles: Roles identified as missing can be assigned via the Roles tab.
    • Adding to Groups: Users can be added to necessary groups through the Groups tab.
    • Show Differences Only: Filters the view to display only roles or groups that differ between the two users, simplifying comparison.

    Compare User Access

    • Access Control Comparison Page: Shows evaluation states (Passed or Blocked) for different ACL operations between users.
    • Evaluation States: Indicate whether access was granted or denied for specific operations.
    • ACL Operation Evaluation Hierarchy: Roles are evaluated first, followed by Security Attributes, Conditions, and Scripts.
    • Role Hierarchy Page: Displays roles assigned to each user, helping identify necessary role and group assignments for access.
    • Viewing Details: Users, roles, and groups can be examined in detail via the More Actions menu to understand their properties and resource access.
    • Show Differences Only: Filters results to highlight only differing operation evaluation states between users.

    Frequently asked questions while using Access Analyzer.

    Evaluate Access

    The following are frequently asked questions while using the Evaluate Access feature of Access Analyzer:

    Table 1. Frequently asked questions
    Questions Explanation
    How to read the evaluation results displayed by the Access Analyzer?

    Each row represents an individual access control list (ACL). The sequence (#) in the results represents the order in which ACLs are evaluated. Status shows whether overall access is granted (passed) or denied (blocked).
    How are ACLs evaluated?

    At a table level, ACLs are evaluated only for roles and security attributes. Conditions and scripts aren’t evaluated.

    Roles are evaluated first. If Roles are blocked, conditions and scripts are skipped. For more information, see Configure an ACL.
    What are the legends in Access Analyzer?

    When Analyzing the access and permissions, legends are displayed as part of the evaluation process. The following are the legends:

    • [Passed] Access granted
    • [Blocked] Access denied
    • [Skipped] Didn’t evaluate
    • [Undefined] No rule found
    What is the Alert icon in the Access results mean?

    Alert Icon in any status indicates the presence of a script in the ACL. Review highlighted ACLs to understand the final access. To know more about how these controls are evaluated and review the logic used to determine the access, see Access Analyzer Debug logs.
    What is IAccesshandler?

    An internal system check using hidden source code on the platform. It’s a system security check that you can’t modify. IAccessHandler can grant or deny access to a resource without evaluating ACLs.

    If this IAccessHandler is ignored, then the ACLs are evaluated. For example, an IAccessHandler implementation is used for access checks on application resources such as read-only access.
    What are data filters? Data filters are a form of access control designed to work along with the existing Access Control rules (ACLs) on your instance.
    What is an ACL rule? Rules for access control lists (ACLs) restrict access to data by requiring users to pass a set of requirements before they can interact with it.

    Time limited role assignments found for the user may impact results. You can review the time-limited roles assigned for the user here.

    Compare user records

    The following are frequently asked questions while using the Compare user record feature in Access Analyzer:

    Table 2. Frequently asked questions
    Questions Explanation
    How to read the results on the Details tab? The Details tab displays the metadata associated with user 1 and user 2
    How to grant a role to a user? From the Roles tab, you can check the role that must be granted for the user and assign that role.
    How to add a user to a group? From the Groups tab, you can check the group the user must be added and add the user to the group.
    What is Show differences only? When you enable the Show differences only check box, only the roles or groups that are different between the user 1 and user 2 are shown.

    Compare user access

    The following are frequently asked questions while using the Compare user access feature in Access Analyzer:

    Table 3. Frequently asked questions
    Questions Explanation
    How to read the results on the access control comparison page? The access control comparison page displays the evaluation states for different ACL operations.
    What are the different evaluation states?

    Evaluation states include:

    • Passed
    • Blocked
    What is Show differences only? When you enable the Show differences only check box, only the operation evaluation states that are different between the user 1 and user 2 are shown.
    How is the ACL operation evaluated?

    Rules for access control lists (ACLs) restrict access to specific data by requiring users to pass a set of requirements before they can interact with it. Within an ACL, the following hierarchy is evaluated:

    • Role
    • Security Attribute
    • Condition
    • Script
    How to read the results shown on the Role Hierarchy page? The Role Hierarchy page displays roles that are assigned to user 1 and user 2. If a user needs access to a certain operation, you can determine the necessary role and group assignments.
    How can I see the details of the user? You can select the User (node) > More actions > View user details to know more about the user.
    How can I see the details of the role? You can select the Role (node) > More actions > View role details to know more about the role.
    How can I see the details of the resources the role can access? You can select the Role (node) > More actions > View all resources that the role has access to know the resources the role can access.
    How can I see the details of the group? You can select the Group (node) > More actions > View group details to know more about the group.