---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Deny-Unless ACL

# Deny-Unless ACL {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Learn details about Deny-Unless ACLs.
Deny-Unless ACLs are evaluated with a "deny-unless" approach. The ACL defines the users that will NOT be denied. Said another way, the user will be denied access unless the role, condition, and script
requirements are met.  
Wichtig:  
Deny-Unless ACLs will take priority against Allow-If ACLs in ACL Evaluation, as it will be evaluated first.  
A Deny-Unless ACL produces two outcomes{#acl-denial-behavior__table_jnn_5pl_zbc__entry__2}

| Evaluation outcome | Result |
|-|-|
| Pass | The defined roles, data conditions, security attributes, and script requirements are met. The ACL proceeds to further evaluation Wichtig: Even if a Deny-Unless ACL matches, access is only granted when an Allow-If ACL explicitly permits it. If no Allow-If ACL is matched and the Deny-Unless ACL passes, the system grants access by default. |
| Fail | The Deny-Unless ACL is marked as failing and access will be denied. |
[ ]

{#acl-denial-behavior__table_jnn_5pl_zbc}  
The following is an explained example of a Deny-Unless ACL:

* ACL has roles sn_hr_core.manager and itil
* Condition has active = true
* script has answer = gs.isLoggedIn();

{#acl-denial-behavior__ul_t3l_tql_zbc}The user is denied access unless all three requirements for this ACL are satisfied. In order for this Deny-Unless ACL to pass, a user needs either the sn_hr_core.manager or itil roles, be accessing a record that has active field = true, and be logged in. The Deny-Unless ACL will fail if any of the three requirements isn't met.