Simple definition
Access Control List; a rule that controls what users or roles can read, create, update, or delete in a system.
In ServiceNow, ACLs can protect records, fields, REST endpoints, UI pages, client-callable Script Includes, and other objects. The platform evaluates relevant rules before allowing the requested operation.
What can a ServiceNow ACL control?
Tables and records
Controls whether users can create, read, update, or delete records on protected tables.
Fields
Restricts access to individual fields even when the user can access the surrounding record.
REST and API access
The same data protections can affect records retrieved or changed through web services and integrations.
Executable objects
ACLs can protect executable resources such as client-callable Script Includes and selected endpoints.
Reporting and list actions
Operations can control reporting, list editing, personalization, and other platform behaviors.
Inherited tables
ACL design needs to account for parent tables, child tables, wildcard rules, and field-level inheritance.
Why ACLs matter in ServiceNow
- Prevent unauthorized access to sensitive security, IT, employee, and business records.
- Enforce least-privilege access for users, groups, service accounts, and integrations.
- Protect fields that are more sensitive than the rest of a record.
- Apply data-security controls to API and integration access, not only to the user interface.
- Support separation of duties and controlled access across scoped applications.
- Reduce the risk of exposing records simply because a user knows a table or API endpoint.
How ServiceNow ACL evaluation works
Identify the requested operation
ServiceNow determines whether the request is for read, create, write, delete, execute, or another protected operation.
Find matching ACLs
The platform finds ACLs that apply to the protected object, including relevant table, field, parent, and wildcard rules.
Evaluate rule requirements
Applicable roles, conditions, scripts, and decision behavior are evaluated.
Resolve object-level access
Record/table access is determined before more specific field-level access is useful.
Apply the result
The platform allows the requested action or hides, blocks, or makes the object read-only depending on the operation.
Debug when necessary
Administrators can use ACL debugging and impersonation to understand which rule granted or denied access.
Key components of an ACL rule
Protected object
Defines the table, field, endpoint, or other object to which the rule applies.
Operation
Specifies what action is being controlled, such as read, write, create, delete, or execute.
Required roles
Can require one or more roles before the user is eligible for access.
Data condition
Can evaluate record values or conditions before access is granted.
Script logic
Can use server-side logic for access decisions that cannot be expressed with simple conditions.
Decision and precedence
Multiple matching ACLs, wildcard rules, field rules, and table inheritance can affect the final access result.
Common ServiceNow ACL operations
Create
Controls whether a user can insert new records into the protected table.
Read
Controls whether a user can view or retrieve protected records or fields.
Write
Controls whether a user can update protected records or fields.
Delete
Controls whether a user can remove protected records.
Execute
Controls execution of selected protected resources such as scripts or endpoints.
Other operations
ServiceNow also supports operations for list editing, reporting, personalization, and other platform capabilities.
ACL vs RBAC vs ServiceNow role
| Concept | Primary purpose | Example |
|---|---|---|
| ACL | Evaluates whether a user can perform a specific operation on a protected object. | Allow members of a security role to read one table but restrict a sensitive field. |
| RBAC | Organizes permissions around job functions and assigned roles. | Security analysts receive a role associated with their operational responsibilities. |
| ServiceNow Role | A named permission or capability that can be assigned directly or through groups. | An ACL requires a specific role before its other conditions are evaluated. |
ServiceNow ACL security best practices
Use least privilege
Grant only the operations, tables, fields, and endpoints required by the real workflow.
Protect sensitive fields
Do not assume table-level read access means every field should be visible.
Test API behavior
Validate how ACLs affect integrations, REST calls, service accounts, and imported data.
Test with realistic users
Use impersonation and non-admin test accounts instead of validating only as an administrator.
Understand inheritance
Review parent tables, wildcard ACLs, scoped application behavior, and field precedence before adding rules.
Document access intent
Record why the rule exists, which users need it, and what should happen when access is denied.
Benefits and common ACL problems
Benefits
- Fine-grained data protection.
- Consistent UI and API security enforcement.
- Support for least privilege and separation of duties.
- Field-level protection for sensitive information.
- Reusable controls across scoped applications.
Common problems
- Rules that are difficult to understand because of inheritance and wildcards.
- Testing only with admin accounts.
- Broad scripted ACLs that are slow or difficult to maintain.
- Unexpected API failures because integration users lack required ACL access.
- Granting roles broadly instead of designing the minimum required access.
How ForshTec helps with ServiceNow access control
ForshTec helps cybersecurity vendors and enterprise teams design ServiceNow applications and SecOps integrations with maintainable, least-privilege access controls.
- ACL design for tables, fields, APIs, and scoped applications
- ServiceNow Store application security reviews
- Integration-user and service-account permission design
- Cross-scope access and role architecture
- ACL troubleshooting, impersonation testing, and regression validation
- Security Operations and custom application development
Need a ServiceNow integration with clean access boundaries?
ForshTec can help design ACLs, roles, APIs, and scoped application permissions around the exact workflow your users and integrations need.
Talk to ForshTecFAQs
What is an ACL in ServiceNow?
An ACL, or Access Control List, is a ServiceNow security rule that controls whether a user can perform an operation on a protected object such as a table, record, field, script, or endpoint.
What operations can a ServiceNow ACL control?
Common record operations include create, read, write, and delete. ServiceNow also supports execute and additional operations for reporting, list editing, personalization, and other platform capabilities.
Do ACLs apply to ServiceNow APIs?
Yes. Record access through web services and integrations is affected by applicable access controls, so service accounts must have the roles and permissions required by the records and operations they use.
What is the difference between an ACL and a role?
A role is a named permission assigned to users or groups. An ACL is an access decision rule that can require roles and also evaluate conditions or scripts for a specific object and operation.
Why can ACL troubleshooting be difficult?
ServiceNow may evaluate table, field, parent, wildcard, and multiple matching ACLs. Inheritance and precedence can make the final decision less obvious without ACL debugging and realistic test users.
Should ServiceNow integrations use admin access?
Generally no. Integration accounts should use the minimum roles and ACL permissions needed for the supported workflow rather than broad administrator privileges.