In ServiceNow, Table Access Control (ACL) rules define the permissions for accessing records within a table. When a user attempts to access a record, ServiceNow processes ACL rules in a specific order to determine if the user has the necessary permissions.
Order of Processing ACL Rules:
Specific Table Name ACLs
ServiceNow first checks ACL rules that are defined for the exact table being accessed.
If there are multiple ACL rules for the same table, ServiceNow evaluates them from most specific to least specific (i.e., field-level ACLs before table-level ACLs).
Parent Table Name ACLs (If applicable)
If the table inherits from another table (e.g., Incident inherits from Task), ServiceNow next checks ACL rules on the parent table.
This ensures that inherited rules are properly applied.
Wildcard ACLs (*) (Any table)
If no explicit ACL rule is found for the table or its parent, ServiceNow checks wildcard ACL rules (*), which apply to all tables.
Wildcard ACLs act as a last resort when no table-specific rules exist.
Explanation of Each Option:
(A) any table name (wildcard), parent table name, table name - Incorrect Wildcard rules (*) are processed last, not first.
(B) table name, parent table name, any table name (wildcard) - Correct
This follows the correct processing order:
First: ACLs for the specific table
Second: ACLs for the parent table (if applicable)
Third: Wildcard ACLs (*)
(C) parent table name, table name, any table name (wildcard) - Incorrect Parent table ACLs are checked after table-specific ACLs, not before.
(D) any table name (wildcard), table name, parent table name - Incorrect Wildcard ACLs (*) are always processed last, so this order is incorrect.
Additional Notes & Best Practices:
Field-level ACLs (column-specific) take precedence over table-level ACLs.
If multiple ACL rules apply, all must evaluate to true for access to be granted.
Explicit Deny: If an ACL rule explicitly denies access, the user is denied, even if another ACL grants access.
Always Test ACLs: Use the "Security Debugging" feature (/sys_security_acl_list.do) to verify how ACLs are applied.
Reference from Certified System Administrator (CSA) Documentation:
ServiceNow Docs: How Access Control Rules Work
https://docs.servicenow.com
ServiceNow Community: Understanding ACL Processing Order
https://community.servicenow.com