---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security
Release :
- brazil
ft:locale :
- en-US
ft:publication_title :
- Brazil Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Enforce domain access control on all tables
# Enforce domain access control on all tables {#ariaid-title1}
Release version: Brazil
Updated September 10, 2026
 1 minute to read
The glide.sys.domain.access_handler.included_tables property controls which tables have cross-domain write protection enforced.
When set to * (wildcard), all tables receive cross-domain write protection. When set to a comma-separated list of specific table names, only
those tables have cross-domain write protection enforced. When left empty, no tables receive cross-domain write protection, disabling the feature.{#sc-enforce-domain-access-control-on-all-tables__sc-enforce-domain-access-control-on-all-tables-para-1}
1. Navigate to /sys_properties_list.do on the instance.
2. Verify the glide.sys.domain.access_handler.included_tables property exists in the `sys_properties` table and is set to *.
{#sc-enforce-domain-access-control-on-all-tables__ol_agq_bgq_dkc}
## More information {#sc-enforce-domain-access-control-on-all-tables__section_hrq_mgq_dkc}
{#sc-enforce-domain-access-control-on-all-tables__table_l5d_fsp_8ui__entry__2}
| Attribute | Description |
|-|-|
| Configuration name | glide.sys.domain.access_handler.included_tables |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | String |
| Recommended value | `*` |
| Default value | `*` |
| Fallback value | Empty |
| Category | [Architecture, design, and threat modeling](https://www.servicenow.com/docs/flZLwb5A4NTOzIsm_05BPA "This broad control addresses high level design considerations and key elements to implement a secure application. This covers the tenants of availability, confidentiality processing integrity, non-repudiation and privacy. Additionally, elements of a secure software development lifecycle are included.") |
| Security risk | * Severity score: 5.6 * Common Vulnerability Scoring System (CVSS) rating: Medium * Security risk details: If glide.sys.domain.access_handler.included_tables is narrowed to a subset of tables, emptied, or if the default configuration is removed, domain boundary enforcement stops. The instance no longer enforces domain boundaries on the affected tables. In a domain-separated (multi-tenant) instance, users in one domain can create or update records with a `sys_domain` value outside their assigned domain. This breaks the tenant isolation that domain separation provides, resulting in unauthorized cross-domain data exposure and data planting. {#sc-enforce-domain-access-control-on-all-tables__ul_jlk_bsp_bkc} |
| Functional impact | The glide.sys.domain.access_handler.included_tables property controls the scope of domain access handler enforcement across tables in the instance. Modifying the value changes which tables receive cross-domain write protection. Expanding the property value toward * (wildcard) increases the scope of domain access handler enforcement. More tables undergo record visibility and access evaluation for domain boundaries. This can affect how users, integrations, and background operations interact with domain-separated data, potentially blocking writes that were previously allowed on tables outside the enforcement scope. Configuration options: * `*` (wildcard) -- Enforce domain access handler on all domain-applicable tables * Comma-separated table list -- Enforce domain access handler only on the specified tables * Empty or absent -- Enforce domain access handler on no tables (enforcement turned off) |
| Dependencies and prerequisites | This property is only evaluated when the Domain Support (`com.glide.domain`) plugin is active. |
[ ]
{#sc-enforce-domain-access-control-on-all-tables__table_l5d_fsp_8ui}