--- sourceDocument: Brazil Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # ACL troubleshooting reference # ACL troubleshooting reference {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of ACL troubleshooting reference This reference guide assists ServiceNow customers in troubleshooting Access Control List (ACL) issues by identifying common ACL rule errors and utilizing debugging tools to resolve access problems. It focuses on ensuring proper permissions and access controls at the ACL level to maintain secure and least-privilege access to resources. Show full answer Show less ## Key Features * **Access Analyzer:** A diagnostic security tool that provides administrators with detailed visibility into permissions for selected users, roles, or groups at the ACL level. It helps identify who has access, detect overly permissive configurations, and enforce least-privilege principles. * **Debugging:** Enables troubleshooting of ACL issues by showing which ACL rules are evaluated for a user or object, helping to pinpoint conflicts, precedence issues, or missing permissions causing access denials. ## Troubleshooting Guidance * **Access issues with custom tables:** Ensure a specific table ACL exists for the custom table, as the default wildcard table ACL restricts access to administrators only. Use debugging to verify evaluated ACL rules. * **Custom ACL rules not working:** Check for conflicting rules with higher precedence or unmet permission requirements. Debugging helps confirm whether the custom ACL is evaluated. * **Field ACL problems:** Confirm no conflicting table ACLs are blocking access and that no duplicate field ACLs exist. Debugging reveals the evaluated ACLs for the field. * **Table ACL conflicts:** Investigate duplicate or higher precedence table ACL rules interfering with intended access. Use debugging to identify the rules affecting access. * **Field visible in list but not form:** ACL conditions or scripts may behave differently between list and form views. Debugging clarifies when ACLs evaluate to true, allowing conditions or scripts to be aligned. * **Errors executing processor or client-callable script include:** Verify ACL rules on the script include and adjust user roles or ACLs if access is expected. Debugging identifies the evaluated ACLs for the script include. * **Users losing previously granted access:** Check if ACLs reference roles that no longer exist in the instance. Use Access Management \> Access Findings to locate and correct invalid role references in ACLs. ## Practical Benefits By applying this troubleshooting guidance and leveraging access analyzer and debugging tools, ServiceNow customers can quickly diagnose and resolve ACL-related access issues. This ensures secure, accurate permission assignment, reliable access control enforcement, and consistent user experience across tables, fields, and scripts. ACL troubleshooting includes identifying ACL rule errors and use the debugging tools to fix the ACL related problems. ## Access analyzer {#r_ACLTroubleshoot__section_nlt_rpb_23c} Access analyzer helps the administrators to view permissions for the selected user, role, or group. It is a diagnostic security tool that provides comprehensive visibility into resource permissions and access controls at the Access Control List (ACL) level, enabling you to understand who has access to their resources, identify overly permissive configurations, and maintain least-privilege access principles. To learn more about how to use the tool, see [Access Analyzer](https://www.servicenow.com/docs/3zAedffdAq6hGfy~1YbUdw "ServiceNow Access Analyzer is an access diagnostic tool designed for AI administrators or creators to validate the access controls configured within various resources and agentic assets (agentic workflows and AI agents)."). ## Enable debugging Enable debugging to help troubleshoot an issue. {#r_ACLTroubleshoot__table_fry_32f_2r__entry__2} | Error or symptom | Solution | |-|-| | You cannot access records from a custom table. | Create a table ACL rule for the custom table granting users access to the table. Without an explicit table ACL rule, users must pass the permissions in the table wildcard (\*) ACL rule, which by default restricts access to administrators only. Enable [debugging](https://www.servicenow.com/docs/rvWqOmPkPPSOuzEA3meyCg "Field level debugging and access ACL rule output messages are available to help you troubleshoot and debug ACLs. The ACL configuration watcher lets you know what related ACLs exist when you modify one.") and determine what ACL rules are evaluated for the custom table. | | You create a custom ACL rule that does not work properly. | The most likely problems are that another rule takes precedence over your custom rule in the processing order or that the user does not meet all the permission requirements for the object type. Enable [debugging](https://www.servicenow.com/docs/rvWqOmPkPPSOuzEA3meyCg "Field level debugging and access ACL rule output messages are available to help you troubleshoot and debug ACLs. The ACL configuration watcher lets you know what related ACLs exist when you modify one.") and verify that the ACL rule is being evaluated. | | Your field ACL rule does not work properly. | There is likely a table ACL rule that the user has not met. Enable [debugging](https://www.servicenow.com/docs/rvWqOmPkPPSOuzEA3meyCg "Field level debugging and access ACL rule output messages are available to help you troubleshoot and debug ACLs. The ACL configuration watcher lets you know what related ACLs exist when you modify one.") and determine what ACL rules are evaluated for the field. Verify that there is not a conflicting table ACL rule or duplicate field ACL rule. | | Your table ACL rule does not work properly. | There is either an ACL rule higher in the processing order or a duplicate table ACL rule interfering with the table ACL rule. Enable [debugging](https://www.servicenow.com/docs/rvWqOmPkPPSOuzEA3meyCg "Field level debugging and access ACL rule output messages are available to help you troubleshoot and debug ACLs. The ACL configuration watcher lets you know what related ACLs exist when you modify one.") and determine what ACL rules are evaluated for the table. | | You can see a field in a list but not in form. | It is possible that the ACL rule conditions or script are being triggered in the list but not in the form. Enable [debugging](https://www.servicenow.com/docs/rvWqOmPkPPSOuzEA3meyCg "Field level debugging and access ACL rule output messages are available to help you troubleshoot and debug ACLs. The ACL configuration watcher lets you know what related ACLs exist when you modify one.") and determine when the ACL rules evaluate to true. Update the conditions or script to have the same behavior on the list and form. | | You receive an error message when trying to execute a processor or client-callable script include. | There is an ACL rule for the processor or client-callable script include that the user has not met. If the user should have access to the object, enable [debugging](https://www.servicenow.com/docs/rvWqOmPkPPSOuzEA3meyCg "Field level debugging and access ACL rule output messages are available to help you troubleshoot and debug ACLs. The ACL configuration watcher lets you know what related ACLs exist when you modify one.") and determine what ACL rules are evaluated for the processor or script include. Update the ACL rule or the user roles as needed to access the object. | | A user who previously had access to an object can no longer access it. | Check whether the ACL protecting the object has roles that don't exist on the instance. If none of the roles on the ACL exist, the system denies access. Go to AllAccess ManagementAccess Findings to find these ACLs in the Access Checks list. Correct the role references. | [Table 1. Troubleshoot] {#r_ACLTroubleshoot__table_fry_32f_2r} *[\>]: and then