ServiceNow Shared Security Model and Access Control Information

As part of ServiceNow’s Shared Security Responsibility Model , ServiceNow provides instance administrators a wide range of built-in features to establish authorization across the platform.

ServiceNow recommends that instance administrators assign user roles in alignment with the principle of least privilege and regularly perform entitlement reviews.

Access Control Lists (ACL) are used in conjunction with built-in role-based access control to enforce authorization to data. When accessing data, user’s roles are evaluated against the ACL to ensure all relevant criteria are met prior to granting access.

ServiceNow Docs: Access control list rules

NowSupport KB: Demystifying Access Controls

ServiceNow Docs: ACL debugging tools

User Criteria is used to enforce authorization for Knowledge Bases and Service Catalogs:

NowSupport KB: Understanding User Criteria and ACLs in Knowledge v3

ServiceNow Docs: Service Catalog: Set security for items and categories

Report access controls :

NowSupport KB: Enabling Report View ACLs (Requires Customer Account to Access)