Resolve cross-scope access errors on the Employee Center portal after plugin installation - Known Error

Resolve cross-scope access errors on the Employee Center portal after plugin installation Description Resolve cross-scope access errors that appear on the Employee Center (/esc) and Employee Center Pro portals after activating the Employee Center and Employee Center Pro plugins without making any other configuration changes.

The errors match the following pattern:

"Read operation on table '[table name]' from scope '[application name]' was denied. The application '[application name]' must declare a cross scope access privilege. Please contact the application admin to update their access requests."

Affected tables include [sn_ja_task], [sn_hr_core_case], and [sn_doc_task]. The failing widget is the Employee Center Header .

Steps to Reproduce

Install or update the Employee Center plugin and the Employee Center Pro plugin. Go to /esc. Cross-scope access errors appear immediately. Errors ----- ErrorRead operation on table 'sn_ja_task' from scope 'Employee Center' was denied. The application 'Employee Center' must declare a cross scope access privilege. Please contact the application admin to update their access requests. Errorcom.glide.script.fencing.access.ScopeAccessNotGrantedException: read access to sn_ja_task not granted ErrorScript source code logged to console ErrorFailing widget: 'Employee Center Header' (d0009941eb103010ed7966d6475228c1) ErrorRead operation on table 'sn_hr_core_case' from scope 'Employee Center' was denied. The application 'Employee Center' must declare a cross scope access privilege. Please contact the application admin to update their access requests. ErrorRead operation on table 'sn_ja_task' from scope 'Employee Center Pro' was denied. The application 'Employee Center Pro' must declare a cross scope access privilege. Please contact the application admin to update their access requests. ----- ErrorRead operation on table 'sn_doc_task' from scope 'Employee Center' was denied. The application 'Employee Center' must declare a cross scope access privilege. Please contact the application admin to update their access requests. Errorcom.glide.script.fencing.access.ScopeAccessNotGrantedException: read access to sn_doc_task not granted ErrorScript source code logged to console ErrorFailing widget: 'Employee Center Header' (d0009941eb103010ed7966d6475228c1) ErrorRead operation on table 'sn_hr_core_case' from scope 'Employee Center' was denied. The application 'Employee Center' must declare a cross scope access privilege. Please contact the application admin to update their access requests. ErrorRead operation on table 'sn_doc_task' from scope 'Employee Center Pro' was denied. The application 'Employee Center Pro' must declare a cross scope access privilege. Please contact the application admin to update their access requests. ----

Workaround These errors occur when Restricted Caller Access (RCA) records shipped with the store app are in a requested or invalidated state and have not yet been approved. The RCA must be approved before the application can access cross-scope resources.

RCAs are classified into three categories:

Real RCA — System-generated during functional flow to access cross-scope resources. Requested RCA — Shipped by the store app in the source scope. Used to grant store apps access to protected resources without waiting for the next family release. Generated RCA — Created at runtime during app installation in the target application scope, based on all Requested RCAs in the requested state. Resolution When you see the cross-scope access error, one or more Restricted Caller Access (RCA) records are in a requested or invalidated state. You must approve these records to grant the application access to the required tables.

To approve pending RCA records:

In the application navigator, search for Restricted Caller Access . Filter the list to show records in the Requested state. Review each record and approve the appropriate RCAs. You need the system admin or application admin role to review, approve, or deny RCA records.

Note: If the errors involve HR tables such as [sn_hr_core_case], those tables have additional access restrictions. After approving the RCA records in the [sys_restricted_caller_access] table, verify access by testing the affected functionality — for example, data visualization or Now Assist panel prompts that filter HR data.