Permission evaluation
Summarize
Summary of Permission Evaluation
Permission evaluation in ServiceNow uses the Access Analyzer to determine if a user, group, or role has the appropriate access to resources. The evaluation follows a specific hierarchy and considers various rule types, including business rules, internal system checks, data filters, and Access Control Lists (ACLs). Understanding this process helps you diagnose and manage access permissions effectively within your ServiceNow instance.
Show less
Evaluation Hierarchy and Process
Access is evaluated in the following order:
- Business Rule: Server-side scripts triggered by record or table operations.
- Access Handler (IAccessHandler): Internal platform checks that can grant or deny access before ACLs are evaluated.
- Data Filtration: Access controls that work alongside ACLs but only support read operations.
- Access Control List (ACL): Rules that restrict data access, evaluated by role, security attributes, conditions, and scripts.
The Access Analyzer impersonates the selected user to evaluate permissions based on these checks. Access is granted only if all relevant checks return a positive ("Passed") result or are undefined/empty.
Rule Types and Supported Operations
- Table Level: Evaluates role and security attribute ACLs.
- Record or Field Level: Evaluates role, security attribute, condition, and script ACLs.
- UI Page: Supports only read operations with read-level ACL evaluation.
- REST Endpoint: Supports execute operations with execute-level ACL evaluation.
Access Analyzer Features
- Presence of Script Indicator: Alerts when ACLs contain scripts affecting permission evaluation.
- Legends: Visual indicators for evaluation outcomes such as Passed (access granted), Blocked (access denied), Skipped (not evaluated), and Undefined (no rule found).
Key Outcomes for ServiceNow Customers
By leveraging the Access Analyzer and understanding the permission evaluation hierarchy, you can:
- Precisely diagnose why a user has or lacks access to specific resources.
- Understand the impact of business rules, access handlers, data filters, and ACLs on access control.
- Identify ACLs containing scripts that influence access decisions for more effective troubleshooting.
- Ensure compliance with access policies by reviewing detailed evaluation results and debug logs.
Permission evaluation criteria when using the Access analyzer.
Evaluation hierarchy
Permission for the selected user, group, or role is evaluated in the following hierarchy:
- Business rule: A business rule is a server-side script that runs when a record is displayed, inserted, updated, or deleted, or when a table is queried.
- Access Handler: An internal system check using hidden source code on the platform.
- Data Filtration: Data filter is a form of access control designed to work along with the existing Access Control rules (ACLs) on your instance. Data filter support only read operation.
- Access control list (ACL): Rules for access control lists (ACLs) restrict access to data by requiring users to pass a set of requirements before they can interact with it. Within an ACL, the following hierarchy is evaluated:
- Role
- Security Attribute
- Condition
- Script
You can analyze access and permissions for the selected user, role, or group using the Access Analyzer. The permissions are evaluated based on the following rule types:
- Table Level Evaluation: Role and security attribute ACLs are used for Table level evaluation.
- Record or Field level Evaluation: Role, security attribute, condition, and script level ACLs are used for Record or Field level evaluation.
- UI page: Support Only ready operations. Only read level ACLs are evaluated.
- REST Endpoint: Support only execute operation. Only execute level ACL are evaluated.
Details about the important fields in the Access Results are as follows:
- Presence of a script
- Access result legend
- Evaluation process
- IAccessHandlers
- Data filters
- Access control list rules
Presence of a script
Alert Icon in any status indicates the presence of a script in the ACL. Review highlighted ACLs to understand the final access. To know more about how these controls are evaluated and review the logic to determine the access, see Access Analyzer Debug logs.
Legend in Access Analyzer
When Analyzing the access and permissions, legends are displayed as part of the evaluation process. Following are the legends:
- [Passed] Access granted
- [Blocked] Access denied
- [Skipped] Did not evaluate
- [Undefined] No rule found
Evaluation process
Evaluation process is carried out by impersonating a user and determining the access control list (ACL) permission on the resource. Permission rules enable access to the specified resource if the following checks are evaluated to true:
- IAccessHandlers must evaluate to “Passed”, or is empty or undefined
- Data filters must evaluate to “Passed”, or is empty or undefined
- Access control rules (ACLs) evaluate to “Passed”
IAccessHandlers
An internal system check using hidden source code on the platform. IAccessHandler can grant or deny access to a resource without evaluating ACLs. If IAccessHandler is ignored, then the ACLs are evaluated.
You can’t change the IAccessHandler checks. For example, an IAccessHandler implementation is used for access checks on application resources such as read access.
Data filter
Data filter is a form of access control designed to work along with the existing Access Control rules (ACLs) on your instance.
Access control list rules
Rules for access control lists (ACLs) restrict access to data by requiring users to pass a set of requirements before they can interact with it.