Honor Admin Override ACLs
The glide.security.admin.override.accessterm property controls whether an administrator can bypass an access rule when a resource (a table or a field) has multiple access rules.
Each individual access rule can be configured to allow or disallow an admin override on its own. When set to true (recommended), each rule's admin override setting is honored individually. A rule explicitly
configured to disallow an admin override still blocks the administrator even if another rule on the same resource permits it.
When set to false, rules are evaluated cumulatively. An admin can bypass one rule's override restriction if any other applicable rule permits it.
Set the glide.security.admin.override.accessterm property to true to ensure that access rules explicitly configured to deny override still blocks admins.
More information
| Attribute | Description |
|---|---|
| Property name | glide.security.admin.override.accessterm |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | Access control |
| Purpose | Controls how admins can bypass an ACL evaluation. |
| Data type | Boolean |
| Recommended value | True |
| Default value | True |
| Security risk | (Low) If access checks are too coarse, one rule's override denial is silently ignored in favor of a more permissive rule on the same resource. This allows admins to read or modify data and configurations that were intentionally locked down. Failure to enforce fine-grained evaluation of these override decisions may result in unauthorized access to sensitive information. |
| Security risk rating | 3.8 |
| Functional impact | When set to Test that admins can't bypass override denials on a resource with multiple layered rules. Verify that if one rule denies admin override, that rule blocks the admin even if another rule permits override. This change has no service availability impact. |
| References | Access Control List Rules |
To learn more about adding or creating a system property, see Add a system property.