An Access Control rule (ACL) in ServiceNow defines who can access data and what actions they can perform on that data. Each ACL consists of three primary components:
Object being secured - The specific table, field, or record that the rule applies to.
Operation - The type of action that is being secured (e.g., Read, Write, Create, Delete).
Permissions required - The conditions, roles, or scripts that determine whether access is granted.
How ACLs Work in ServiceNow:
ACLs evaluate whether a user has permission to access a specific table, field, or action.
The security rules are processed from most specific to least specific (e.g., field-level > table-level).
Permissions can be granted based on roles, conditions, or custom scripts using GlideSystem (gs).
Explanation of Incorrect Options:
A . Groups, Conditional Expressions, and Workflows ❌ (Incorrect)
ACLs do not manage workflows or directly control group assignments.
B . Table Schema, CRUD, and User Authentication ❌ (Incorrect)
CRUD (Create, Read, Update, Delete) permissions are controlled by ACLs, but User Authentication is managed separately through login policies (LDAP, SSO, etc.).
D . security_admin ❌ (Incorrect)
security_admin is a special elevated role required to modify security settings, but it is not what an ACL specifies.
Official Reference from Certified System Administrator (CSA) Documentation:
Access Control Rules Overview:
https://docs.servicenow.com/en-US/bundle/utah-platform-security/page/administer/security/concept/access-control-rules.html Configuring ACLs in ServiceNow:
https://docs.servicenow.com/en-US/bundle/utah-platform-security/page/administer/security/task/t_CreateOrModifyAnAccessControl.html