---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Restrict vault code signing audit exclusion to defaults

# Restrict vault code signing audit exclusion to defaults {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Manage which tables are excluded from Vault Code Signing audit tracking to maintain visibility into changes on protected code artifacts.
The com.glide.codesigning.tables.excluded_from_audit property lists tables excluded from Vault Code Signing audit tracking. Create, update, and delete operations on these tables don't generate an audit entry,
even when a table would otherwise be eligible for Code Signing auditing.

The platform ships this property scoped only to Code Signing's own internal operational tables: certificate storage, crypto module/policy configuration, signing job tracking, and related bookkeeping tables. This prevents the audit
noise from internal state changes. Any table name added beyond this default list is also excluded from audit tracking. This property doesn't distinct between an internal housekeeping table and a table containing actual protected,
signed code artifacts.

To configure this property:

1. Navigate to /sys_properties_list.do on the instance.
2. Confirm the com.glide.codesigning.tables.excluded_from_audit property either does not exist in the sys_properties table or is set to the following comma-separated list of table names:

       sys_restricted_caller_access,sys_scope_master, sys_kmf_crypto_caller_policy, sys_kmf_crypto_module, sn_cse_codesigning_transaction, sn_cse_configuration_property, sn_cse_quorum_request,sys_certificate,sysauto_script,
                   sys_signing_job,sys_mass_encryption_job

## More information {#sc-restrict-vault-code-signing-audit-exclusion-list-to-default-tables__section_more_info-restrict-vault-code-signing-audit-exclusion-list-to-default-tables}

{#sc-restrict-vault-code-signing-audit-exclusion-list-to-default-tables__table_property_details-restrict-vault-code-signing__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | com.glide.codesigning.tables.excluded_from_audit |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | String (comma-separated table names) |
| Recommended value | sys_restricted_caller_access,sys_scope_master, sys_kmf_crypto_caller_policy,sys_kmf_crypto_module,sn_cse_codesigning_transaction, sn_cse_configuration_property, sn_cse_quorum_request,sys_certificate, sysauto_script,sys_signing_job,sys_mass_encryption_job |
| Default value | sys_restricted_caller_access,sys_scope_master, sys_kmf_crypto_caller_policy, sys_kmf_crypto_module,sn_cse_codesigning_transaction, sn_cse_configuration_property, sn_cse_quorum_request, sys_certificate,sysauto_script, sys_signing_job,sys_mass_encryption_job |
| Fallback value | sys_restricted_caller_access,sys_scope_master, sys_kmf_crypto_caller_policy,sys_kmf_crypto_module, sn_cse_codesigning_transaction,sn_cse_configuration_property, sn_cse_quorum_request, sys_certificate,sysauto_script, sys_signing_job,sys_mass_encryption_job |
| Category | [Error handling and logging](https://www.servicenow.com/docs/6IiaQ2VC~8mgbeGyGuLaKw "The error handling and logging category addresses the quality and verbosity of logged information exposed to stakeholders.") |
| Security risk | * Security risk rating: Medium * CVSS score: 5.1 * Security risk details:Expanding this list beyond the platform-defined default removes audit visibility for added tables. This can include the very tables that store the protected, signed code artifacts this feature exists to monitor. An administrator or a compromised integration with write access to this property could narrow audit coverage for a specific table without disabling Code Signing auditing overall. This allows the instance to continue to appear fully audited while visibility into changes on that specific table has been silently removed. |
| Functional impact | Adding a table name to this property stops audit generation for that table's create, update, and delete operations. Removing a table name (or restoring the default list) resumes audit tracking for that table. Changing this property affects only audit trail generation. It has no effect on Code Signing signature validation, enforcement, or the signing mechanism itself. Tables can be excluded from auditing without impacting the signing feature's functionality. |
| Dependencies and prerequisites | No effect unless both com.snc.kmf.signature.validation.optin and sn_cse.com.snc.csf.vault_audit_enabled are true. |
[ ]

{#sc-restrict-vault-code-signing-audit-exclusion-list-to-default-tables__table_property_details-restrict-vault-code-signing}