---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enforce application specific ACLs only for application data

# Enforce application specific ACLs only for application data {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Enforce application specific ACLs only for application data

This feature enhances security by enforcing application-specific Access Control Lists (ACLs) exclusively for application data, including data stored in primary tables outside the application's scope.
When enabled, only the ACLs specific to the application are evaluated for access, preventing unauthorized or unintended data access from general table ACLs.
Show full answer Show less  
This enforcement is controlled via system properties named using the format **glide.enforcesecurityscope.\<scope\>** , where each application scope that supports this feature has a corresponding property. Setting the property value to **true** activates enforcement for that application.

## Key Features

* **Application-specific ACL enforcement:** Restricts data access checks to ACLs defined within the application scope.
* **System property configuration:** Each supported application has a dedicated Boolean system property in the **sysproperties** table to enable or disable enforcement.
* **Scoped administrator control:** Only scoped administrators can modify these system properties, ensuring controlled and secure changes.
* **Support for multiple application scopes:** Numerous ServiceNow applications, including HR, GSM, IMT, and others, provide this property for fine-grained ACL control.
* **Script availability:** A provided script helps identify which properties are missing or incorrectly set, facilitating compliance verification.

## Practical Application for ServiceNow Customers

* **Verify and enable enforcement:** For each installed application with the **glide.enforcesecurityscope.\<scope\>** property, ensure the value is set to **true** to enforce application-specific ACLs.
* **Create missing properties:** If an application lacks this system property, create it to enable enforcement.
* **Check impact:** Be aware that enabling this might restrict access for users not actively using the application, as only application-specific ACLs are considered.
* **Security benefits:** Reduces risk of unauthorized data access by preventing broader table ACLs from granting unintended permissions.

## Security Considerations

Enabling this feature addresses a medium severity security risk (CVSS score 4.1) where primary table ACLs could otherwise allow unauthorized access. It is recommended to enable this property for all supported applications to maintain robust data security.

## Additional Notes

No dependencies or prerequisites are required to enable this feature. For guidance on adding or updating system properties, consult the ServiceNow documentation on managing system properties.  
Avoid unauthorized or undesired access to application data by enforcing application-specific access control lists (ACLs) only for application data.
Enforce application-specific ACLs for application data residing in primary tables outside the application. When these properties have a value of true, only the application-specific ACLs are evaluated for
access to the application data residing in these tables. Not all applications are designed to work in this configuration or use a System Property \[sys_properties\] record for this purpose.  
These system properties use the glide.enforce_security_scope.\<scope\> naming format. For example, use the glide.enforce_security_scope.sn_hr_sp property for the Employee Center Core (sn_hr_sp) scope. The following application scopes contain this property:

|-|-|-|-|
| * sn_doc * sn_egd_act * sn_egd_core * sn_egd_goals * sn_em * sn_gsm * sn_gsm_info_req * sn_gsm_lic_prmt * sn_gsm_lic_prmt_ex * sn_gsm_soc_bnfts {#sc-enforce-application-specific-acls-only-for-application-data__ul_qfp_pfg_32c} | * sn_hc_professional * sn_hr_agent_ws * sn_hr_ai_agents * sn_hr_awa * sn_hr_core * sn_hr_ef * sn_hr_er * sn_hr_gen_ai * sn_hr_hc * sn_hr_le * sn_hr_ra {#sc-enforce-application-specific-acls-only-for-application-data__ul_cng_qfg_32c} | * sn_hr_le_ent * sn_hr_mii_base * sn_hr_na_galileo * sn_hr_pad * sn_hr_pj * sn_hr_sp * sn_hr_va * sn_hr_ws * sn_imt_health_test * sn_imt_tracing * sn_imt_vaccine {#sc-enforce-application-specific-acls-only-for-application-data__ul_ety_qfg_32c} | * sn_ja * sn_jny * sn_lg_contracts * sn_lg_matter * sn_lg_ops * sn_opp_market * sn_professional * sn_svc_appl_info * sn_svc_appl_pgm_mg * sn_talent_aia * sn_uni_req * sn_uni_task * sn_egd_lh * sn_ecn * sn_ni_core * sn_hr_voice_aia * sn_tf * sn_lco_cmn {#sc-enforce-application-specific-acls-only-for-application-data__ul_zrv_rfg_32c} |
[ ]

{#sc-enforce-application-specific-acls-only-for-application-data__table_whg_pfg_32c}

For each application installed with the glide.enforce_security_scope property in the System Properties \[sys_properties\] table, (for example, glide.enforce_security_scope.sn_hr_core), verify
the property value is set to true.  
Note:  
These properties can only be modified by the scoped administrator for the specific application. If a sys_properties record does not exist for the given application and respective property, it must be created.  
Use this script can to find which properties must be updated or created on the instance:

    var properties = [
            'glide.enforce_security_scope.sn_uni_task',
            'glide.enforce_security_scope.sn_uni_req',
            'glide.enforce_security_scope.sn_svc_appl_info',
            'glide.enforce_security_scope.sn_professional',
            'glide.enforce_security_scope.sn_opp_market',
            'glide.enforce_security_scope.sn_lg_ops',
            'glide.enforce_security_scope.sn_lg_matter',
            'glide.enforce_security_scope.sn_lg_contracts',
            'glide.enforce_security_scope.sn_jny',
            'glide.enforce_security_scope.sn_ja',
            'glide.enforce_security_scope.sn_imt_vaccine',
            'glide.enforce_security_scope.sn_imt_tracing',
            'glide.enforce_security_scope.sn_imt_health_test',
            'glide.enforce_security_scope.sn_hr_ws',
            'glide.enforce_security_scope.sn_hr_va',
            'glide.enforce_security_scope.sn_hr_sp',
            'glide.enforce_security_scope.sn_hr_pj',
            'glide.enforce_security_scope.sn_hr_pad',
            'glide.enforce_security_scope.sn_hr_mii_base',
            'glide.enforce_security_scope.sn_hr_le',
            'glide.enforce_security_scope.sn_hr_le_ent',
            'glide.enforce_security_scope.sn_hr_hc',
            'glide.enforce_security_scope.sn_hr_gen_ai',
            'glide.enforce_security_scope.sn_hr_er',
            'glide.enforce_security_scope.sn_hr_ef',
            'glide.enforce_security_scope.sn_hr_core',
            'glide.enforce_security_scope.sn_hr_awa',
            'glide.enforce_security_scope.sn_hr_agent_ws',
            'glide.enforce_security_scope.sn_hc_professional',
            'glide.enforce_security_scope.sn_gsm_soc_bnfts',
            'glide.enforce_security_scope.sn_gsm_lic_prmt_ex',
            'glide.enforce_security_scope.sn_gsm_lic_prmt',
            'glide.enforce_security_scope.sn_gsm_info_req',
            'glide.enforce_security_scope.sn_gsm',
            'glide.enforce_security_scope.sn_em',
            'glide.enforce_security_scope.sn_egd_goals',
            'glide.enforce_security_scope.sn_egd_core',
            'glide.enforce_security_scope.sn_egd_act',
            'glide.enforce_security_scope.sn_doc',
            'glide.enforce_security_scope.sn_talent_aia',
            'glide.enforce_security_scope.sn_hr_na_galileo',
            'glide.enforce_security_scope.sn_svc_appl_pgm_mg',
            'glide.enforce_security_scope.sn_hr_ai_agents',
            'glide.enforce_security_scope.sn_egd_lh',
            'glide.enforce_security_scope.sn_ecn',
            'glide.enforce_security_scope.sn_ni_core',
            'glide.enforce_security_scope.sn_hr_voice_aia',
            'glide.enforce_security_scope.sn_hr_ra',
            'glide.enforce_security_scope.sn_tf',
            'glide.enforce_security_scope.sn_lco_cmn'
        ];
    	
    var pm = new GlidePluginManager();

        for (var i = 0; i < properties.length; i++) {
            var property = properties[i];
            var application = property.split('.')[2];
            var propertyValue = gs.getProperty(property, 'false');

            if (pm.isActive(application) && propertyValue.toLowerCase() != 'true') {
                gs.print(property);
            }
        }

## More information {#sc-enforce-application-specific-acls-only-for-application-data__section_ghv_dvg_1xb}

{#sc-enforce-application-specific-acls-only-for-application-data__table_hhv_dvg_1xb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.enforce_security_scope.\<scope\> |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Category | [Access control](https://www.servicenow.com/docs/x7vcJqvJ0dwOasc9M2~48A "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Functional impact | Users who aren't actively using the application may not have access to application data residing in scope main tables. Not all applications are designed to work in this configuration or include a sys_properties record for this feature. |
| Security risk | * Severity score: 4.1 * CVSS score: Medium * Security risk details: When these properties don't have a value of true, the ACLs on the primary table are still evaluated for access, potentially allowing unauthorized or undesired access to application data. {#sc-enforce-application-specific-acls-only-for-application-data__ul_ihv_dvg_1xb} |
| Dependencies and prerequisites | None |
[ ]

{#sc-enforce-application-specific-acls-only-for-application-data__table_hhv_dvg_1xb}

To learn more about adding or creating a system
property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=brazil&pubname=brazil-platform-administration&ft:locale=en-US).