--- sourceDocument: Zurich Build or modify applications sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/application-development Release : - zurich ft:locale : - en-US ft:publication_title : - Zurich Build or modify applications ft:clusterId : - cadev bundleId : - cadev workflow : - Development, Data, and Analytics --- # ACL API # Access Control List API - ServiceNow Fluent {#ariaid-title1} Release version: Zurich Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 7 minutes to read The Access Control List API defines access control lists \[sys_security_acl\] that secure parts of an application. Note: For the latest ServiceNow Fluent API documentation and examples, see the [ServiceNow Fluent API reference](https://servicenow.github.io/sdk/category/api-reference) and [ServiceNow SDK examples repository](https://github.com/ServiceNow/sdk-examples) on GitHub. For general information about access control lists (ACLs), see [Access Control List Rules](https://www.servicenow.com/docs/access?context=access-control-rules&version=zurich&pubname=zurich-platform-security&ft:locale=en-US). **Related concepts** * [ServiceNow Fluent](https://www.servicenow.com/docs/ohv0rMJ2O_nhoDa98apEXg "Define application metadata in source code using the ServiceNow Fluent domain-specific programming language.") ## ACL object {#ariaid-title2} Configure a custom ACL rule \[sys_security_acl\] to secure access to new objects or to change the default security behavior. ACLs must include one or more roles, a security attribute, a condition, or a script. {#acl-object-now-ts__table_vy2_525_jq__entry__3}{#acl-object-now-ts__now-id-desc2} | Name | Type | Description | |-|-|-| | $id | String or Number | Required. A unique ID for the metadata object. When you build the application, this ID is hashed into a unique sys_id. For more information, see [ServiceNow Fluent language constructs](https://www.servicenow.com/docs/eZmQbP~actTVoJVsA0Jb8Q "ServiceNow Fluent language constructs provide additional functionality for development in source code with ServiceNow Fluent APIs."). Format: `Now.ID['String' or Number]` | | operation | String | Required. The operation that this ACL rule secures. An ACL rule can only secure one operation. To secure multiple operations, create a separate ACL rule for each. The operation must be `execute` if the type property is client_callable_flow_object, client_callable_script_include, graphql, processor, or rest_endpoint. Valid values: * execute: Allow users to execute scripts on a record or UI page. * create: Allow users to insert new records (rows) into a table. * read: Allow users to display records from a table. * write: Allow users to update records in a table. * delete: Allow users to remove records from a table or drop a table. * conditional_table_query_range: Enables users to give partial ACL-access based on read ACLs. Created for the tables that have the read ACLs without Data condition and script. * data_fabric: Enable users to allow Data Fabric connectors to access data on a particular table. * query_match: Enables users to submit match queries (such as "is", "is not", and "is empty"). * query_range: Enables users to submit range queries (such as "starts with", "ends with", and "contains") and sorting is unrestricted. * edit_task_relations: Allow users to extend the Task \[task\] table. * edit_ci_relations: Allow users to extend the Configuration Item \[cmdb_ci\] table. * save_as_template: Allow users to save a record as a template. * add_to_list: Allow users from viewing or personalizing specific columns in the list mechanic. Conditions and scripts aren't supported. * report_on: Allow users to report on tables. * list_edit: Allow users to update records (rows) from a list. * report_view: Allow users to report on field ACLs. * personalize_choices: Allow users to configure the table or field. {#acl-object-now-ts__ul_lbx_zfn_kfc} | | type | String | Required. The type of object that this ACL rule secures. The type determines which operations are available. After creating an ACL rule, if you want to change the type, you must delete the ACL and create a new one with the correct type. Valid values: * record * rest_endpoint * ui_page * processor * graphql * pd_action * ux_data_broker * ux_page * ux_route * client_callable_flow_object * client_callable_script_include {#acl-object-now-ts__ul_gmv_nnn_kfc} Default: record | | active | Boolean | Flag that indicates whether the ACL rule is enforced. Valid values: * true: The ACL rule is enforced. * false: The ACL rule isn't enforced. {#acl-object-now-ts__ul_cxj_srr_4bc} Default: true | | adminOverrides | Boolean | Flag that indicates whether users with the admin role automatically pass the permissions check for this ACL rule. Valid values: * true: Administrators automatically pass the permissions check.If true, admin users pass the permissions check regardless of what script or role restrictions apply. However, the nobody role, which only ServiceNow personnel can assign, takes precedence over the admin override option. If an ACL is assigned the nobody role, admin users cannot access the resource even when adminOverrides is true. For more information, see [Base system roles](https://www.servicenow.com/docs/access?context=r_BaseSystemRoles&version=zurich&pubname=zurich-platform-administration&ft:locale=en-US). * false: Administrators must meet the permissions defined in this ACL rule to gain access to the secured object. Use the condition or script properties to create a permissions check that administrators must pass. {#acl-object-now-ts__ul_nxn_q35_pbc} Default: true | | script | Script | A custom script that defines the permissions required to access the object. This property supports a function from a JavaScript module, a reference to another file in the application that contains a script, or inline JavaScript. ACLs must include one or more roles, a security attribute, a condition, or a script. Note: If the type property is `graphql`, scripts aren't supported. The script can use the values of the `current` and `previous` global variables and system properties. The script must generate a true or false response in one of two ways: * return an `answer` variable set to a value of true or false * evaluate to true or false {#acl-object-now-ts__ul_kww_zpb_zbc}In either case, users only gain access to the object when the script evaluates to true and the user meets any conditions the ACL rule has. Both the conditions and the script must evaluate to true for a user to access the object. Note: If the evaluated item is in a related list, `current` points to the item the related list is on, not to the current item the ACL is for. However, If the item you are evaluating the ACL for is not in a related list, `current` points to the actual item. Format: * For functions, use the name of a function, function expression, or default function exported from a JavaScript module and import it into the .now.ts file. For information about JavaScript modules, see [JavaScript modules and third-party libraries](https://www.servicenow.com/docs/e2YvWZmVSrYZotPVBJPGew "Optimize your code base using JavaScript modules to group related code or add third-party libraries and reuse their code within applications.").{#acl-object-now-ts__script-function} * To use text content from another file, refer to a file in the application using the following format: `Now.include('path/to/file')`. For more information, see [ServiceNow Fluent language constructs](https://www.servicenow.com/docs/eZmQbP~actTVoJVsA0Jb8Q "ServiceNow Fluent language constructs provide additional functionality for development in source code with ServiceNow Fluent APIs."). * To provide an inline script, use string literals or template literals for multiple lines of code: ``'Script' or `Script```. {#acl-object-now-ts__ul_rtr_vyd_1gc} | | description | String | A description of the object or permissions this ACL rule secures. | | localOrExisting | String | The type of security attribute to apply. Valid values: * Local: A security attribute based on the condition property that is saved only for the ACL it is created in. * Existing: An existing security attribute to reference in the security_attribute property. {#acl-object-now-ts__ul_e3w_ddd_mbc} Default: Local | | decisionType | String | An option for whether the ACL should allow or deny access. Valid values: * allow: The ACL allows access. * deny: The ACL denies access. {#acl-object-now-ts__ul_bx2_kvj_ccc} Default: allow | | condition | String | A filter query that specifies the fields and values that must be true for users to access the object. For more information, see [Operators available for filters and queries](https://www.servicenow.com/docs/access?context=r_OpAvailableFiltersQueries&version=zurich&pubname=zurich-platform-user-interface&ft:locale=en-US). ACLs must include one or more roles, a security attribute, a condition, or a script. | | roles | Array | A list of variable identifiers of Role objects or sys_ids of roles that a user must have to access the object. For more information, see [Role API - ServiceNow Fluent](https://www.servicenow.com/docs/zYHTv3iGBk8Pi4pBlw~kyA#role-api-now-ts "The Role API defines roles [sys_user_role] that grant specific permissions to users of an application."). ACLs must include one or more roles, a security attribute, a condition, or a script. Note: Users with the admin role always pass this permissions check because the admin role automatically grants users all other roles. | | securityAttribute | String | Pre-defined conditions for the ACL to use. For example, whether a user is impersonating another user. For more information about security attributes, see [OOB (Out-of-Box) Security Attributes](https://www.servicenow.com/docs/access?context=oob-security-attributes&version=zurich&pubname=zurich-platform-security&ft:locale=en-US). ACLs must include one or more roles, a security attribute, a condition, or a script. Note: For security attributes with the Is localized field set to true, the localOrExisting property of the ACL should be set to Local. If the Is localized field is false, the localOrExisting property should be set to Existing. | | table | String | The name of the table to which the ACL applies. This property only applies and is required if the type property is one of the following values: ux_data_broker, ux_page, ux_route, pd_action, or record. | | field | String | The name of a field on the table to secure. You can use the wildcard character (`"*"`) to select all fields. | | name | String | The name of the ACL. This property only applies and is required if the type property is one of the following values: rest_endpoint, ui_page, processor, graphql, client_callable_flow_object, or client_callable_script_include. | | protectionPolicy | String | A policy that determines whether someone can view or edit the script include after the application is installed on their instance. If undefined, other application developers can customize the script include. Valid values: * read: Allows anyone to read values from this downloaded or installed script include. No one can change script values on the instance on which they download or install the script include. * protected: Provides intellectual property protection for application developers. Customers who download the script include cannot see the contents of the script field. The script is encrypted in memory to prevent unauthorized users from seeing it in plain text. {#acl-object-now-ts__ul_o3h_nbz_j3c} | | $meta | Object | Metadata for the application metadata. With the installMethod property, you can map the application metadata to an output directory that loads only in specific circumstances. $meta: { installMethod: 'String' } Valid values for installMethod: * demo: Outputs the application metadata to the metadata/unload.demo directory to be installed with the application when the Load demo data option is selected. * first install: Outputs the application metadata to the metadata/unload directory to be installed only the first time an application is installed on an instance. {#acl-object-now-ts__ul_n3q_y3s_42c} | [Table 1. Properties] {#acl-object-now-ts__table_vy2_525_jq} import { Acl } from "@servicenow/sdk/core"; export default Acl({ $id: Now.ID['task_delete_acl'], active: true, adminOverrides: true, type: 'record', table: 'task', field: 'description', operation: 'delete', roles: [adminRole, managerRole], }) The roles referenced are defined using the Role object: import { Role } from "@servicenow/sdk/core"; const managerRole = Role({ $id: Now.ID['manager_role'], name: 'x_snc_example.manager' }) const adminRole = Role({ $id: Now.ID['admin_role'], name: 'x_snc_example.admin', containsRoles: [managerRole] })