Resolve sys_restricted_caller_access records appearing in sys_update_xml and update setsIssue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Resolve an issue where [sys_restricted_caller_access] records appear in the [sys_update_xml] table and attach to update sets. These records are created when a scoped application attempts to access a resource in a different scope, triggering a cross-scope privilege check. The records must be manually removed from update sets if they are not addressed at the source. Here is an example of the sys_update_xml table with these records: Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } All supported releases Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } [sys_restricted_caller_access] records are created when a record in one application scope attempts to access a resource in a different scope. This triggers a cross-scope privilege check and creates a record in [sys_restricted_caller_access] — which is then captured in [sys_update_xml] and can attach to active update sets. You can review some more information regarding Cross Scope Privileges here: Cross-scope privilege record Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Step 1: Find the sys_restricted_caller_access records in sys_update_xml Go to the [sys_update_xml] table and filter by records where Name starts with sys_restricted_caller_access. Use the following URL (replace <INSTANCE> with your instance name): https://<INSTANCE>.service-now.com/nav_to.do?uri=%2Fsys_update_xml_list.do%3Fsysparm_query%3DnameSTARTSWITHsys_restricted_caller_access%26sysparm_first_row%3D1%26sysparm_view%3D%26sysparm_choice_query_raw%3D%26sysparm_list_header_search%3Dtrue Step 2: Read the payload to identify the source Open a record and read the Payload field. Near the top of the XML, locate the following elements: <source> — contains the sys_id of the source record<source_table> — contains the table name of the source record<source_scope> — contains the sys_id of the source application scope<target_scope> — contains the sys_id of the target application scope<operation> — contains the operation being attempted (for example, "write") Example payload excerpt: <?xml version="1.0" encoding="UTF-8"?><record_update table="sys_restricted_caller_access"><sys_restricted_caller_access action="INSERT_OR_UPDATE"><operation>write</operation><source>ebc7ec91672222002e640731b2415af7</source><source_scope display_value="Security Support Common">f38c97005301120034c69816a11c081d</source_scope><source_table>sysauto_script</source_table><source_type>3</source_type><status>2</status><sys_class_name>sys_restricted_caller_access</sys_class_name><sys_created_by>system</sys_created_by><sys_created_on>2021-01-15 14:11:50</sys_created_on><sys_customer_update>false</sys_customer_update><sys_id>13e0ab14dbfda414bb5a4a2813961996</sys_id><sys_mod_count>0</sys_mod_count><sys_name>82878663ff123100158bffffffffff67</sys_name><sys_package display_value="Security Incident Response" source="sn_si">82878663ff123100158bffffffffff67</sys_package><sys_policy/><sys_replace_on_upgrade>false</sys_replace_on_upgrade><sys_scope display_value="Security Incident Response">82878663ff123100158bffffffffff67</sys_scope><sys_update_name>sys_restricted_caller_access_13e0ab14dbfda414bb5a4a2813961996</sys_update_name><sys_updated_by>system</sys_updated_by><sys_updated_on>2021-01-15 14:11:50</sys_updated_on><target name="sn_si_incident" target_table="sys_db_object">d2ec8e6fdbd4241059ac6e25ca96194c</target><target_scope display_value="Security Incident Response">82878663ff123100158bffffffffff67</target_scope><target_table>sys_db_object</target_table><target_type>1</target_type></sys_restricted_caller_access></record_update> Step 3: Find the source record Using the source_table and source sys_id from the payload, go to the source table and filter by the sys_id. For example, if source_table is sysauto_script and source is ebc7ec91672222002e640731b2415af7, go to [sysauto_script] and filter by that sys_id. Use the following URL pattern (replace <INSTANCE>, <source_table>, and <sys_id> with the values from the payload): https://<INSTANCE>.service-now.com/<source_table>_list.do?sysparm_query=sys_idSTARTSWITH<sys_id>&sysparm_first_row=1&sysparm_view= Step 4: Determine whether to create a cross-scope privilege Using the source_scope, target_scope, and operation values from the payload, you can now understand which scope is trying to access which resource and what operation is being attempted. Decide whether the access should be permitted: If the access should be permitted: Create a cross-scope privilege record to allow the source scope to access the target scope for the specified operation. This prevents the [sys_restricted_caller_access] record from being created each time the access is attempted. See the Related Links section for instructions.If the access should not be permitted: Leave the [sys_restricted_caller_access] record in place. Review the source script or record to determine whether the cross-scope access is intentional and whether it should be removed. Repeat steps 1 through 4 for each [sys_restricted_caller_access] record in [sys_update_xml]. As you create cross-scope privileges where appropriate, the number of new records created decreases over time. Related Links<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } How to fix the red popup "... must declare a cross scope access privilege" errors Cross-scope privilege record Define cross-scope access to an application resource