---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Permission evaluation

# Permission evaluation {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 Minuten Lesedauer

Understand permission evaluation criteria when using Access Analyzer.

## Evaluation hierarchy {#permission-evaluation__section_nlp_v4d_cyb}

Permission for the selected user, group, or role is evaluated in the following hierarchy:

* Business rule: A business rule is a server-side script that runs when a record is displayed, inserted, updated, deleted, or when a table is queried.
* Access Handler: An internal system check using hidden source code on the platform.
* Data Filtration: Data filters are a form of access control designed to work with existing Access Control rules (ACLs) on your instance. Data filters support only read operations.
* Access control list (ACL): Rules for access control lists (ACLs) restrict access to specified data by requiring users to pass a set of requirements before they can interact with it. Within an ACL, the following hierarchy is evaluated:
  * Role
  * Security Attribute
  * Condition
  * Script
  {#permission-evaluation__ul_nh3_bpd_cyb}

{#permission-evaluation__ul_cb1_y4d_cyb}

You can analyze access and permissions for the selected user, role, or group using Access Analyzer. Permissions are evaluated based on the following rule types:

* Table Level Evaluation: Role and security attribute ACLs are used for Table level evaluation.
* Record or Field level Evaluation: Role, security attribute, condition, and script level ACLs are used for Record or Field level evaluation.
* UI page: Supports only read operations. Only read level ACLs are evaluated.
* REST Endpoint: Support only execute operation. Only execute level ACL are evaluated.

{#permission-evaluation__ul_gy2_wv2_1yb}

The Access results table includes:

* Presence of a script (alert icon)
* Access result legend
* Evaluation process
* IAccessHandlers
* Data filters
* Access control list rules
{#permission-evaluation__ul_xgs_1cg_qxb}

## Presence of a script {#permission-evaluation__section_hsp_znb_1yb}

An Alert Icon next to any status indicates the presence of a script in the ACL. Review highlighted ACLs to understand the final access. To know more about how these controls are evaluated and review the logic used to determine access,
see [Access Analyzer Debug logs](https://servicenow-prod.fluidtopics.net/ZkNXoJwLIdmuZpSoKAI9TA "Access Analyzer debug logs supply detailed information about the evaluation of access controls for a specific operation. These logs assist administrators and developers in troubleshooting access issues, optimizing security configurations, and ensuring that users have appropriate access to resources within the ServiceNow platform.").

## Status in Access Analyzer {#permission-evaluation__section_vg3_j2g_qxb}

When analyzing access and permissions, Access Analyzer shows the evaluation's result or status. Statuses include:

* \[Passed\] Access granted
* \[Blocked\] Access denied
* \[Skipped\] Did not evaluate
* \[Undefined\] No rule found
{#permission-evaluation__ul_ehh_k2g_qxb}

## Evaluation process {#permission-evaluation__section_r54_fcg_qxb}

The evaluation process is carried out by impersonating a user and by determining the access control list (ACL) permissions on the resource. Permission rules enable access to the specified resource if the following checks are evaluated
to true:

* IAccessHandlers must evaluate to "Passed", or is empty or undefined
* Data filters must evaluate to "Passed", or is empty or undefined
* Access control rules (ACLs) evaluate to "Passed"
{#permission-evaluation__ul_uvv_hcg_qxb}

## IAccessHandlers {#permission-evaluation__section_zpv_lcg_qxb}

IAccessHandlers are an internal system check using hidden source code on the platform. IAccessHandler can grant or deny access to a resource without evaluating ACLs. If IAccessHandler is ignored, then the ACLs are evaluated.

You can't change the IAccessHandler checks. For example, an IAccessHandler implementation is used for access checks on application resources such as read access.

## Data filters {#permission-evaluation__section_gy1_5cg_qxb}

Data filters are a form of access control designed to work along with the existing Access Control rules (ACLs) on your instance.

## Access control list rules {#permission-evaluation__section_wmv_5cg_qxb}

Rules for access control lists (ACLs) restrict access to specific data by requiring users to pass a set of requirements before they can interact with it.