ServiceNow uses Restricted Caller Access (RCA) to secure scoped applications like HR from unauthorized interactions with other parts of the platform. When a cross-scope attempt (such as a script in the Global scope trying to access an HR table) occurs for the first time, the system automatically adds a record to the Restricted Caller Access Privileges table and sets its status to " Requested " . This mechanism ensures that the interaction is blocked by default until an administrator reviews and approves it. This " gatekeeper " approach is vital for protecting sensitive HR data, as it prevents accidental or malicious data access between scopes. Administrators must then manually change the status to " Allowed " if the cross-scope call is legitimate, ensuring full control over which external scripts or applications can interact with the HR environment.