In what order are record ACL rules processed?

• A. Field ACL first, then Table ACL
• B. Table ACL first, then Field ACL
• C. Random order based on priority
• D. Both are processed simultaneously

Answer: (B)

Record ACL rules in ServiceNow are processed in a specific order for efficiency and clarity in security checks. First, the system evaluates Table ACL rules, which apply to the entire table and determine if a user's operation is permitted on any record within that table. This initial evaluation is crucial because it establishes a baseline level of access for all records.

After the Table ACL check, the system processes Field ACL rules. These rules refine access further by controlling permissions on specific fields within the records of the table. This two-step process ensures that access is not only restricted at the table level but also at the individual field level, aligning with the principle of least privilege.

This sequential approach allows for a clear hierarchy in access controls, ensuring that overarching table-level permissions set the stage before diving into finer-field specifications.