Review cross-scope privilege policies

task brazil Updated Sep 10, 2026 2 min read review-cross-scope-policy-arp.md

Review automatically created cross-scope privilege policy records and change their status as needed based on intended application behavior.

Before you begin

For cross-scope privilege policies to be automatically generated, Application Runtime Policy (ARP) must be enabled in either Tracking or Enforcing mode for the application you're developing.
If ARP is in Enforcing mode, you must review and approve the generated cross-scope privilege policies before the application can access the specified resource. For more information about Tracking and Enforcing modes, see Application Runtime Policy modes.

Role required: arp_admin or admin.

About this task

Note: All policy records generated by ARP must be in the Allowed or Denied state before publishing to the Application Repository or the ServiceNow Store. Policies left in the Requested state block publication.

Procedure

Navigate to All > System Policy > Application Runtime Policy > Cross Scope Privilege.
From the list, locate a policy record with the Requested status and review the policy details.

Policies with the Allowed or Denied status can also be reviewed and changed as needed.
Double-click the value in the Status field (or use the keyboard shortcut) to open the drop-down list of status options.
Select an option to allow or block resource access as defined in the policy.
- Select Allowed to enable access.
- Select Denied to block access.
Select the Save (Enter) icon[Omitted image "releaseops-save-enter-icon.png"] or use the Enter key to save your selection.
Repeat for each Requested policy record.

Result

Cross-scope privilege policies with the Allowed status permit the application to call the specified script or access the specified table in other application scopes. The cross-scope call completes successfully when the application functionality is next exercised.

Cross-scope privilege policies with the Denied state prevent the application from calling the specified script or accessing the specified table in another application scope. To prevent errors, make sure the application doesn't continue attempting to access the blocked resource.

Changing policy status from the table

[Omitted image "change-arp-status-brazil.gif"] Alt text: Double-click or use the keyboard shortcut to change the status from Requested to Allowed

Parent Topic:Using Application Runtime Policy

Keywords cross-scope privilegeARPApplication Runtime Policyapprove policyEnforcing mode

60 lines · 3.4 KB Wrap lines

---
title: Review cross-scope privilege policies
description: Review automatically created cross-scope privilege policy records and change their status as needed based on intended application behavior.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/application-development/review-cross-scope-policy-arp.html
release: brazil
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 2
keywords: [cross-scope privilege, ARP, Application Runtime Policy, approve policy, Enforcing mode]
breadcrumb: [Use, Application Runtime Policy \(ARP\), Developing your application, Classic app development, Building applications]
---

# Review cross-scope privilege policies

Review automatically created cross-scope privilege policy records and change their status as needed based on intended application behavior.

## Before you begin

- For cross-scope privilege policies to be automatically generated, Application Runtime Policy \(ARP\) must be enabled in either Tracking or Enforcing mode for the application you're developing.
- If ARP is in Enforcing mode, you must review and approve the generated cross-scope privilege policies before the application can access the specified resource. For more information about Tracking and Enforcing modes, see [Application Runtime Policy modes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/application-development/arp-modes.md).

Role required: arp\_admin or admin.

## About this task

**Note:** All policy records generated by ARP must be in the **Allowed** or **Denied** state before publishing to the Application Repository or the ServiceNow Store. Policies left in the **Requested** state block publication.

## Procedure

1. Navigate to **All** &gt; **System Policy** &gt; **Application Runtime Policy** &gt; **Cross Scope Privilege**.

2. From the list, locate a policy record with the **Requested** status and review the policy details.

Policies with the **Allowed** or **Denied** status can also be reviewed and changed as needed.

3. Double-click the value in the **Status** field \(or use the keyboard shortcut\) to open the drop-down list of status options.

4. Select an option to allow or block resource access as defined in the policy.

- Select **Allowed** to enable access.
- Select **Denied** to block access.
5. Select the Save \(Enter\) icon\[Omitted image "releaseops-save-enter-icon.png"\] or use the Enter key to save your selection.

6. Repeat for each **Requested** policy record.

## Result

Cross-scope privilege policies with the **Allowed** status permit the application to call the specified script or access the specified table in other application scopes. The cross-scope call completes successfully when the application functionality is next exercised.

Cross-scope privilege policies with the **Denied** state prevent the application from calling the specified script or accessing the specified table in another application scope. To prevent errors, make sure the application doesn't continue attempting to access the blocked resource.

## Changing policy status from the table

\[Omitted image "change-arp-status-brazil.gif"\] Alt text: Double-click or use the keyboard shortcut to change the status from Requested to Allowed

**Parent Topic:**[Using Application Runtime Policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/application-development/using-arp.md)