ACL (Access Control)
An ACL (Access Control rule) grants or denies an operation — create, read, write, delete — on a table, a field or a record, based on required roles, a condition and an optional script that sets the answer variable.
Also searched as: access control rule, sys_security_acl, ServiceNow ACL.
In practice
Rules evaluate from most specific to least: table.field, then table.*, then the parent table. Roles, condition and script must all pass. A failing field ACL masks only that field; the row stays visible when the table ACL passes.
Example
A read ACL on incident that returns true only for the caller, the assignee or an admin, evaluated for every row in the list.
answer = false;
var me = gs.getUserID();
if (gs.hasRole('admin') || current.assigned_to == me || current.caller_id == me) {
answer = true;
}What interviewers check
Evaluation order plus 'why not query another table inside a read ACL' (list performance) is the standard pair of follow-ups.
Practise this topic
Related Platform terms
- Update SetAn Update Set is a bundle of configuration changes captured on one instance so they can be previewed and committed on another — the standard way to move work from dev to test to production.
- Scoped ApplicationA Scoped Application is an app with its own namespace (for example x_acme_hr) that isolates its tables, scripts and artifacts from other applications and restricts what outside code can touch.