Access Control

Access control lists (ACLs) restrict access to data by requiring users to pass a set of requirements before they can interact with it.

In addition to creating new ACLs or modifying existing ones, you can configure other aspects of ACL functionality.

A Deny-Unless ACL grants access only when a user meets all defined role, condition, and script requirements. If any requirement is unmet, access is denied.

Ask the ACL Explainer AI agent about an access control list (ACL), a table, a field, or another resource in everyday language. Sample prompts and examples show how to phrase questions and the responses to expect.

When evaluating access to a function field, in addition to checking access to the function field itself, the system also checks access to the function's contributing fields. Contributing fields are those used as the arguments in a given function definition.

Create ACLs on different components of the system.

Learn about Allow ACLs (access control lists).

Field level debugging and access ACL rule output messages are available to help you troubleshoot and debug ACLs. The ACL configuration watcher lets you know what related ACLs exist when you modify one.

The ACL configuration watcher lets you know what related ACLs exist on a table when you insert, update, or delete an ACL on the same table.

The default deny property (glide.sm.default_mode) controls the security manager default behavior when the only matching ACL rules are the wildcard table ACL rules.

Learn how to create a datatype ACL.

The datatype ACL enables you to write ACLs that apply to all fields of a specific type.

Set a system property to enable the Audit Roles table to create audit records related to user roles.

Explore access control lists (ACLs).

Query ACLs enable more granular access control by defining who can query the data.

ACL troubleshooting includes identifying ACL rule errors and use the debugging tools to fix the ACL related problems.

Use a system property to perform access control list (ACL) rule validation when server-side records (for example, tables) are accessed using GlideAjax APIs within a client script.

Contextual Security Manager protects your data by controlling read, write, create, and delete authorization.

Use the glide.sys_reference_row_check system property to enable scripted conditions for reference fields.

When the system determines that a particular field (such as task.number) should not be written to by the current user, the system renders that field in a read-only mode, which is why the number field is not writable on most incidents.

The Security jump-start access control level (ACL Rules) plugin is installed automatically on all new instances. Use this plugin to quickly secure multiple system tables and expedite the production launch process for your organization.

Related record access enable consistent control over what records users are able to access between related tables.

Contextual Security: Role Management V2 is automatically installed on new instances. You can upgrade from Contextual Security: Role Management to Contextual Security: Role Management V2 to eliminate duplicate roles in the User Roles table and prevent future duplicates.

Roles inherited from other roles are added as individual entries in the User Roles table [sys_user_has_role], potentially causing one role to have duplicate entries. Contextual Security: Role Management V2 eliminates these duplicate entries and prevents future duplicates.

Configure custom access control list (ACLs) to secure access to new objects or to change the default security behavior.

If you want to force ACL evaluation for admin overrides at the access level, you can add a system property.

To enable users with only the snc_external role to access the list view of a table, you must create a series of ACLs.

To apply security to the records in embedded lists, limit editing and deleting records in embedded lists to specific roles.

Administrators can view how ACLs relate to each other by viewing an execution plan for any ACL in the instance.

Use the ACL configuration watcher after you elevate to security_admin role.

UserHasRoleInhCountPatcher job for resolving role inheritance discrepancies.