<h2>Advanced ACL configuration</h2><br/><div style="overflow-x:auto"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head><meta content="text/html; charset=UTF-8" /><meta name="copyright" content="(C) Copyright 2025" /><meta name="DC.rights.owner" content="(C) Copyright 2025" /><meta name="generator" content="DITA-OT" /><meta name="DC.type" content="concept" /><meta name="DC.title" content="Advanced ACL configuration" /><meta name="abstract" content="In addition to creating new ACLs or modifying existing ones, you can configure other aspects of ACL functionality." /><meta name="description" content="In addition to creating new ACLs or modifying existing ones, you can configure other aspects of ACL functionality." /><meta name="DC.creator" content="ServiceNow" /><meta name="DC.date.created" content="2023-08-03" /><meta name="DC.date.modified" content="2024-08-01" /><meta name="DC.format" content="XHTML" /><meta name="DC.identifier" content="acl-advanced-config" /><link rel="stylesheet" type="text/css" href="../../../CSS/commonltr.css" /><title>Advanced ACL configuration</title></head><body id="acl-advanced-config"> <h1 class="title topictitle1" id="ariaid-title1">Advanced ACL configuration</h1> <div class="body conbody"><p class="shortdesc">In addition to creating new ACLs or modifying existing ones, you can configure other aspects of ACL functionality.</p> <div class="section" id="acl-advanced-config__section_ed4_sml_zbc"><h2 class="title sectiontitle">Deny ACL rules</h2> <p class="p"></p> <div class="sectiondiv">Deny-Unless</div> </div> <div class="section" id="acl-advanced-config__section_c5c_sml_zbc"><h2 class="title sectiontitle">Query ACL rules</h2> <p class="p"></p> </div> <div class="section" id="acl-advanced-config__section_xrt_gmn_l1b"> <div class="p"> <div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="acl-advanced-config__table_umv_kmn_l1b" class="table" frame="border" border="1" rules="all"><colgroup><col /><col /></colgroup><thead class="thead" style="text-align:left;"><tr class="row"><th class="entry nocellnorowborder" style="vertical-align:top;" id="d43839e70">Task</th><th class="entry cell-norowborder" style="vertical-align:top;" id="d43839e73">Description</th></tr></thead><tbody class="tbody"><tr class="row"><td class="entry nocellnorowborder" style="vertical-align:top;" headers="d43839e70 "><a class="xref" href="../reference/r_ContScriptCondAppRefFld.html" title="Use the glide.sys_reference_row_check system property to enable scripted conditions for reference fields.">Apply ACL script conditions to reference fields</a></td><td class="entry cell-norowborder" style="vertical-align:top;" headers="d43839e73 ">Enable a property to allow script conditions to apply to reference fields if you want to control access to the data that a reference field displays on a form or in a list. There might be an impact to the performance of your instance if you enable this.</td></tr><tr class="row"><td class="entry nocellnorowborder" style="vertical-align:top;" headers="d43839e70 "><a class="xref" href="../../security/reference/r_ApplyACLsToAJAXGlideRecord.html" title="Use a system property to perform access control list (ACL) rule validation when server-side records (for example, tables) are accessed using GlideAjax APIs within a client script.">Apply ACLs to AJAXGlideRecord (client-side Glide record)</a></td><td class="entry cell-norowborder" style="vertical-align:top;" headers="d43839e73 ">Apply ACLs to <span class="keyword apiname">GlideAjax</span> API calls so that the system queries only the data that the currently connected user has rights to access.</td></tr><tr class="row"><td class="entry nocellnorowborder" style="vertical-align:top;" headers="d43839e70 "><a class="xref" href="../task/t_EvalAdmOverrideAccLevel.html" title="If you want to force ACL evaluation for admin overrides at the access level, you can add a system property.">Evaluate the admin override at the access level</a></td><td class="entry cell-norowborder" style="vertical-align:top;" headers="d43839e73 ">Force ACL evaluation for admin overrides at the access level. By default, users with the admin role automatically pass the permissions check for this ACL rule when the Admin Overrides option is selected on the <a class="xref" href="../task/t_CreateAnACLRule.html" title="Configure a custom Access Control List (ACL) rule to secure access to new objects or to change the default security behavior.">ACL rules form</a>.</td></tr><tr class="row"><td class="entry row-nocellborder" style="vertical-align:top;" headers="d43839e70 "><a class="xref" href="c_AccessControlRulesDebug.html" title="Field level debugging and access ACL rule output messages are available to help you troubleshoot and debug ACLs. The ACL configuration watcher lets you know what related ACLs exist when you modify one.">Use ACL debugging and troubleshooting tools</a></td><td class="entry cellrowborder" style="vertical-align:top;" headers="d43839e73 ">Use tools like the ACL watcher, field level debugging, and access ACL rule output messages to help you troubleshoot and debug ACLs.</td></tr></tbody></table> </div> </div> </div> </div> </body></html></div>