What is an ACL?

ACL stands for Access Control List, and from ServiceNow themselves...

"ACLs or Access Control Lists are the process by which ServiceNow provides granular security for its data and can be applied to individual records, as well as fields within those records."

What this translates to is that an ACL is a tool used to secure objects within a ServiceNow instance. Those objects we are securing can range from data in tables, processors, Client-callable Script Includes, UI Pages to Reports and even the way in which users can query tables. Every table in ServiceNow can (and should) have at least some ACLs applied to it. ACLs have an Operation value which defines which operation or action a user can perform on a table and its data.

For example the read ACL secures the action of reading data from a table, while the report_view ACL secures the action of viewing a table's data in a report (or as ServiceNow now refers to them, a Data Visualization) and the write ACL secures as you would expect the action of writing to a table.

An ACL is itself a data record held within the ServiceNow database and as such has some features in common with all other ServiceNow objects, for example and ACL has a name and an active property. The table that ACLs reside in is the sys_security_acl table and an XML representation of each ACL exists within the database just like any other record in ServiceNow.

Image: XML representation of an ACL.

Lesson Summary

An Access Control List (ACL) in ServiceNow is a tool used for providing granular security for data within ServiceNow tables. Key points about ACLs include:

• ServiceNow uses ACLs to secure data at both record and field levels within tables.
• ACLs are essential for maintaining data security in ServiceNow.
• ACLs have different types that secure various actions related to table data:
  • Read ACL secures the action of reading data.
  • Report_view ACL secures viewing data in reports or Data Visualizations.
  • Write ACL secures the action of writing to a table, etc.
• ACLs are stored as data records in the sys_security_acl table within the ServiceNow database.
• ACLs have common features found in ServiceNow objects such as a name and an active property.
• Each ACL in ServiceNow has an XML representation within the database similar to other ServiceNow records.