Guest users receive HTTP 403 submitting record producer via Service Catalog REST API after Australia upgrade Issue ProblemUnauthenticated (guest) users can no longer submit a record producer from the Service Portal after upgrading to the Australia version. The submission fails with an HTTP 403 error before the endpoint script runs. The error occurs when using the spScUtil.submitProducer method to call the POST /api/sn_sc/v1/servicecatalog/items/{sys_id}/submit_producer endpoint. Logged-in users and administrators are unaffected. The issue is observed in the Service Catalog REST API scope. Release Australia Cause There is a new ACL includes the 'UserIsAuthenticated' security attribute, which intentionally restricts record producer submissions to authenticated users only. This change caused submissions from guest users on the public portal to fail with a 403 (Forbidden) error at the ACL level, even with the 'Requires Authentication' flag on the REST API unchecked. Before Australia: Access was controlled by the Requires authentication setting on the API resource.After Australia: Access is controlled by both the Requires authentication setting and the newly introduced REST_Endpoint ACL protecting the same API endpoint. Resolution Steps to Resolve1. Create a new path-matching ACL to permit guest users to access the order_now API, ensuring it does not include restrictive security attributes like UserIsAuthenticated. 2. Test the new ACL configuration thoroughly in a sub-production instance before deploying it to the production environment. 3. Avoid modifying out-of-box ACLs directly to prevent conflicts during future upgrades.