What is ACL in ServiceNow?
An ACL (Access Control List rule) decides who can read, create, write or delete records and fields in ServiceNow. ACLs are the main way to protect data on the platform.
How ACLs work
Each ACL applies to an operation (read, write, create, delete and others) on a table or field. ACLs are named after what they protect: incident covers the table, incident.* covers all fields, and incident.short_description covers one field. A user must pass both a table-level and a field-level ACL to access a field.
Roles, conditions and scripts
An ACL can check three things: required roles, a condition on the record, and a script. All configured checks must pass for the ACL to grant access. For example, an ACL could let users read incidents only if they have the itil role or are the caller on that incident.
Evaluation order
ServiceNow checks the most specific ACL first, such as a field ACL on the exact table, before falling back to parent tables and wildcard rules. If several ACLs exist for the same object, passing any one of them grants access, unless a deny-unless ACL blocks it. Deny-unless ACLs, available in recent releases, make it easier to enforce strict restrictions.
Best practices
Use roles and conditions before scripts, because they are faster and easier to audit. Grant roles through groups rather than to individual users. Test access by impersonating users, and use the Access Analyzer and debug security tools to understand why access was granted or denied. Creating and changing ACLs requires elevating to the security_admin role.
Common mistakes
Hiding a field with a UI policy is not security; the data can still be read through lists, reports or APIs. Overly complex ACL scripts slow down lists and are hard to maintain.
Frequently asked questions
Is an ACL the same as a role?
No. A role is a set of permissions given to users. ACLs are the rules that check those roles, and other conditions, to decide access.
Why can an admin see everything?
Users with the admin role pass most ACLs by default, unless an ACL is configured to require something else.
How do I debug ACLs?
Use the Access Analyzer or enable security debugging, then impersonate the user and reproduce the issue.
Related ServiceNow terms
Need help with ACL or anything else in ServiceNow? We’re here with practical solutions that fit your organization and your teams.
Browse all 100 ServiceNow terms
ServiceNow is a trademark of ServiceNow, Inc. This glossary is an independent resource by Sequal Consultancy and is not affiliated with or endorsed by ServiceNow, Inc.