Key Features

• Tracking Cross-Scope Access Requests: The system creates sysrestrictedcalleraccess records to log cross-scope access attempts whenever caller access is set to Caller Restriction or Caller Tracking. This allows you to monitor which applications request access to resources in other scopes.
• Approval and Denial of Access: You can use these records to approve or deny access requests, granting precise control over which applications or scripts can interact with resources outside their own scope.
• Flexible Access Privilege Combinations: Multiple combinations of access can be configured, including:
• Scope-to-scope
• Scope-to-target
• Source-to-scope
• Source-to-target
• These combinations allow you to specify access permissions at varying levels—ranging from entire scopes to specific resources within a scope—to enforce strict boundary controls.

Activation and Configuration

• Activating Restricted Caller Access: You can activate this feature by enabling the Scoped Application Restricted Caller Access plugin (com.glide.scope.access.restrictedcaller), which requires admin privileges.
• It is also enabled by default in applications such as HR Service Delivery and Security Incident Response.
• Additionally, you can enable restricted caller access for Workflow Studio by setting the appropriate system property.
• Defining Access: Use the Restricted Caller Access Privileges [sysrestrictedcalleraccess] table to create records that specify whether access is permitted or denied between source and target scopes or resources.

Practical Benefits for ServiceNow Customers

• Enforces secure, granular control of cross-application resource access to prevent unauthorized data exposure or operations across application boundaries.
• Provides visibility into cross-scope access attempts, supporting governance and compliance requirements.
• Enables flexible configuration to accommodate complex application architectures with multiple scopes, helping maintain system integrity and operational security.