Application Runtime Policy modes
When enabled, Application Runtime Policy operates in two possible modes: Tracking and Enforcing. Tracking mode automatically allows out-of-scope access attempts, while Enforcing mode automatically blocks out-of-scope access attempts until you review them.
Tracking mode
When Application Runtime Policy (ARP) is set to tracking mode for an application you're developing, network and cross-scope policy records are generated during development and set to the Allowed. No access is blocked, and you don't have to manually approve out-of-scope access attempts. If anything in the policy records does require modification, you can make manual changes as needed.
When a violation occurs in tracking mode, an informational message appears on the application page the violation originated from, indicating that the application attempted out-of-scope access. The access is allowed and any features that rely on out-of-scope access function as programmed.
Note: If you use Tracking mode while developing an application, you must change the mode to Enforcing before the application can be published to the ServiceNow Store or the Application Repository.
Enforcing mode
When an application is set to enforcing mode during development, ARP automatically creates network and cross-scope policy records but sets the state to Requested by default. Until the application author approves a policy, the corresponding access attempt is blocked.
When a violation occurs in enforcing mode, an error message appears on the application page indicating that the access attempt was blocked. Features that rely on the out-of-scope access might not be loaded, or might not function properly. You must navigate to the applicable policy table, find the policy record, and set its status to Allowed to enable access.
When an application with ARP in Enforcing mode is installed in another instance, either from the Application Repository or the ServiceNow Store, ARP functions in the following ways:
- ARP does not automatically create policy records in a requested state, even with the mode set to Enforcing.
- ARP blocks access to out-of-scope resources like tables, scriptables, script includes, and network APIs for which no policies exist.
- All blocked access attempts are logged in the ARP Violation Log table for administrator review.
Note: All policy records generated by ARP must be in the Allowed or Denied state before publishing to the Application Repository or the ServiceNow Store. Policies left in the Requested state block publication.
Parent Topic:Configuring Application Runtime Policy
--- title: Application Runtime Policy modes description: When enabled, Application Runtime Policy operates in two possible modes: Tracking and Enforcing. Tracking mode automatically allows out-of-scope access attempts, while Enforcing mode automatically blocks out-of-scope access attempts until you review them. locale: en-US canonical_url: https://www.servicenow.com/docs/r/application-development/arp-modes.html release: brazil topic_type: concept last_updated: "2026-09-10" reading_time_minutes: 2 keywords: [Application Runtime Policy modes, Tracking mode, Enforcing mode, ARP] breadcrumb: [Configure, Application Runtime Policy \(ARP\), Developing your application, Classic app development, Building applications] --- # Application Runtime Policy modes When enabled, Application Runtime Policy operates in two possible modes: Tracking and Enforcing. Tracking mode automatically allows out-of-scope access attempts, while Enforcing mode automatically blocks out-of-scope access attempts until you review them. ## Tracking mode When Application Runtime Policy \(ARP\) is set to tracking mode for an application you're developing, network and cross-scope policy records are generated during development and set to the **Allowed**. No access is blocked, and you don't have to manually approve out-of-scope access attempts. If anything in the policy records does require modification, you can make manual changes as needed. When a violation occurs in tracking mode, an informational message appears on the application page the violation originated from, indicating that the application attempted out-of-scope access. The access is allowed and any features that rely on out-of-scope access function as programmed. **Note:** If you use Tracking mode while developing an application, you must change the mode to Enforcing before the application can be published to the ServiceNow Store or the Application Repository. ## Enforcing mode When an application is set to enforcing mode during development, ARP automatically creates network and cross-scope policy records but sets the state to **Requested** by default. Until the application author approves a policy, the corresponding access attempt is blocked. When a violation occurs in enforcing mode, an error message appears on the application page indicating that the access attempt was blocked. Features that rely on the out-of-scope access might not be loaded, or might not function properly. You must navigate to the applicable policy table, find the policy record, and set its status to **Allowed** to enable access. When an application with ARP in Enforcing mode is installed in another instance, either from the Application Repository or the ServiceNow Store, ARP functions in the following ways: - ARP does not automatically create policy records in a requested state, even with the mode set to Enforcing. - ARP blocks access to out-of-scope resources like tables, scriptables, script includes, and network APIs for which no policies exist. - All blocked access attempts are logged in the ARP Violation Log table for administrator review. **Note:** All policy records generated by ARP must be in the **Allowed** or **Denied** state before publishing to the Application Repository or the ServiceNow Store. Policies left in the **Requested** state block publication. **Parent Topic:**[Configuring Application Runtime Policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/application-development/configuring-app-runtime-policy.md)
This file has no frontmatter.