---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enforce strict deny for ACLs referencing only deleted or non-existent roles

# Enforce strict deny for ACLs referencing only deleted or non-existent roles {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Manage how the system handles access control lists that reference roles deleted from the system.
The glide.security.acl_with_invalid_roles_strict_deny property controls how the system handles access control lists (ACLs) that reference roles that have been deleted from the system. When enabled (the
default), any ACL containing only non-existent role references is explicitly denied access and logged as an error, preventing potential unauthorized access. When turned off, such misconfigured ACLs fall back to default logic that
may grant access based on authentication state alone, potentially bypassing intended role-based restrictions.

This property protects against ACLs with deleted role references and executes on every record-level access check.

To configure this property:

1. Navigate to /sys_properties_list.do on the instance.
2. Ensure the glide.security.acl_with_invalid_roles_strict_deny property exists in the sys_properties table and is set to <kbd class="ph userinput">true</kbd>.

## More information {#sc-enforce-deny-acls-referencing-deleted-roles__section_more_info-enforce-deny-acls-referencing-deleted-roles}

{#sc-enforce-deny-acls-referencing-deleted-roles__table_property_details__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.security.acl_with_invalid_roles_strict_deny |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | false |
| Category | [Access control](https://www.servicenow.com/docs/x7vcJqvJ0dwOasc9M2~48A "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Security risk | * Security risk rating: Medium * CVSS score: 5.1 * Security risk details:Disabling this property allows ACLs with deleted role references to fall back to default logic. Access is granted based on authentication alone, bypassing intended role requirements. Users without the originally-required role can access protected records after role deletion. This is particularly risky during role cleanup or application uninstalls that leave orphaned ACL references. This failure mode is silent and difficult to detect. It risks unauthorized data exposure or modification until misconfigured ACLs are manually remediated. |
| Functional impact | When enabled (the default), this property denies access to ACLs with all role references deleted and logs errors identifying affected rules for remediation. Partially invalid ACLs are unaffected. Only fully-orphaned role references trigger the denial, and the check incurs negligible performance overhead since invalid-role status is determined at ACL load time. Access is denied for ACLs with only deleted role references. Update these rules with valid roles instead of relying on fallback behavior. |
| Dependencies and prerequisites | None |
[ ]

{#sc-enforce-deny-acls-referencing-deleted-roles__table_property_details}