---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Restrict script authorship to authorized users only

# Restrict script authorship to authorized users only {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
The glide.security.scripting_governance.enabled property controls whether users must hold the script-writer role to create or modify executable script content across the platform.
When this property is enabled, users must hold the script-writer role to author or import records containing executable script content. Script content includes business rules, email templates, conditions, workflows, and HTML or XML
code.
When this property is turned off, any user can create or modify code without authorization. Disabling this property removes a critical access boundary and allows any user, including low-privilege, guest, or malicious accounts, to inject arbitrary code into the system.  
Important:  
This property is a foundational security control that prevents unauthorized code execution. Disabling it exposes the platform to significant security risks including privilege escalation, data exfiltration, and system compromise.

To configure this property:

* Navigate to /sys_properties_list.do on the instance.
* Ensure glide.security.scripting_governance.enabled doesn't exist in the sys_properties table or is set to <kbd class="ph userinput">true</kbd>.
{#sc-restrict-script-authorship-to-authorized-users__table_6ou_9jk_2ik__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.security.scripting_governance.enabled |
| Configuration type | System Properties ( /sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | true |
| Category | [Access control](https://www.servicenow.com/docs/x7vcJqvJ0dwOasc9M2~48A "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Security risk | * Severity score: 4.3 * CVSS rating: Low * Security risk details: Disabling script governance removes the authorization gate on code authorship platform-wide. Any user can create or modify executable scripts that run with system privileges.An attacker with low-privilege or guest access can inject malicious code into business rules, conditions, or workflows. The code executes automatically, enabling data theft, privilege escalation, and persistent backdoors. This completely undermines platform security and enables full system takeover. {#sc-restrict-script-authorship-to-authorized-users__ul_g1g_3sf_xwb} |
| Functional impact | None |
| Dependencies and prerequisites | None |
[ ]

{#sc-restrict-script-authorship-to-authorized-users__table_6ou_9jk_2ik}