---
sourceDocument: Yokohama Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/platform-security

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Scope protections for Credentials and Connections

# Scope protections for Credentials and Connections {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

You can classify certain types of Connection \& Credential records as belonging to a scope, and extend scope protections to them.
These scope policies protect records you create in a table, and prevent interactions with records that are private to another scope.  
An Application field is available in the Connection \[sys_connection\] and Discovery Credentials \[discovery_credentials\] tables for associating these types of records to specific scopes. It is not visible on UI forms in Yokohama, but you can easily add it to them. To learn more about these record types, and adding the field to their UI forms, see:

* [Getting started with connections](https://www.servicenow.com/docs/cwZTiX4KUOIENoxn8fajTg "Use the connections table to set up a Basic, JMS, JDBC, or HTTP(s) connection to a target host.")
* [Getting started with credentials](https://www.servicenow.com/docs/WwyyPxQDHWw8t7HIbe~8LQ "The MID Server uses the credentials you create in the Credentials [discovery_credentials] table to access resources for Discovery, Orchestration, Service Mapping, and Cloud Management.")
* [Credential aliases for Discovery](https://www.servicenow.com/docs/FVq1dvMxCrxeHQjVH_ivMg#discovery-credential-alias "Credential aliases for Discovery allow an administrator to use specific credentials on Discovery schedules. You can configure behaviors for your aliases that determine how strictly the system enforces their use.")
* [Configuring the form layout](https://www.servicenow.com/docs/access?context=configure-form-layout&version=yokohama&pubname=yokohama-platform-administration&ft:locale=en-US)
{#scope-protections-connections-credentials__ul_rbb_nbc_xlb}
Restricting the use of a Connection \& Credentials record to a specific scope is important for managing applications that require enforced security. These applications include HR Service Delivery or Security Operations Connection \& Credentials records created in scoped administered applications are not visible to admin users. Associating a Connection \& Credentials record to a specific application scope affords the following protections:

* Applies Access Control List rules (ACLs) to restricted scopes. To learn more about scoped ACLs, see [Access control list rules](https://www.servicenow.com/docs/c9xHDL8wRNRg8PhYPudQ8Q "Rules for access control lists (ACLs) restrict access to data by requiring users to pass a set of requirements before they can interact with it.").  
  Note:  
  Some applications using scope administration and enforced security may require additional setup. To learn more, see [Manage HR roles](https://www.servicenow.com/docs/access?context=c_ManageRoles&version=yokohama&pubname=yokohama-employee-service-management&ft:locale=en-US)
* Protects records when queried using a script. If you do a query from the Global scope, and the Connection \& Credential record is in a protected scope, it doesn't appear in the query, unless given access to it.
{#scope-protections-connections-credentials__ul_d1b_f5s_vlb}

You can customize and grant access to query-restricted records by using Restricted Caller
Access. To learn more, see [Restricted caller access privilege
settings](https://www.servicenow.com/docs/access?context=restricted-caller-access-privilege&version=yokohama&pubname=yokohama-application-development&ft:locale=en-US). Scoping restrictions
also apply to all children tables of the Connection \[sys_connection\] and Discovery Credentials
\[discovery_credentials\] tables. Empty fields and other scopes are not restricted.  
Note:  
Scope protections are only enabled for specific secured scopes to avoid confusion when setting up new records. If someone makes a connection in their scoped application scope, it doesn't have automatic scope restriction.