An ACL for a table may include table.none access control or a table.* access control, but never both.

An ACL for a table may include table.none access control or a table.* access control, but never both.

• A. True
• B. False
• C. Not applicable
• D. Only one may exist at a time

Answer: (B)

In ServiceNow, you can have multiple access control entries that target the same table, and those entries can use patterns like table.* and table.none. Access decisions are not limited to a single ACL rule; the system evaluates all applicable ACLs for the requested operation and user context, with more specific or explicit rules taking precedence. For example, you might have a table.* ACL that broadly allows a read operation for a broad group, and separately a table.none ACL that explicitly denies that same operation for a specific role or condition. When a user in that specific role attempts the read, the denial rule can apply, overriding the broader grant for that scenario. This demonstrates that both table.none and table.* can exist and be effective in the overall access control strategy. So the statement is false: you can indeed have both types of ACLs defined for the same table to implement layered or exception-based security.

In ServiceNow, you can have multiple access control entries that target the same table, and those entries can use patterns like table.* and table.none. Access decisions are not limited to a single ACL rule; the system evaluates all applicable ACLs for the requested operation and user context, with more specific or explicit rules taking precedence.

For example, you might have a table.* ACL that broadly allows a read operation for a broad group, and separately a table.none ACL that explicitly denies that same operation for a specific role or condition. When a user in that specific role attempts the read, the denial rule can apply, overriding the broader grant for that scenario. This demonstrates that both table.none and table.* can exist and be effective in the overall access control strategy.

So the statement is false: you can indeed have both types of ACLs defined for the same table to implement layered or exception-based security.