--- sourceDocument: Australia Platform security sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security Release : - australia ft:locale : - de-DE ft:publication_title : - Australia Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Configure module access policies for Field Encryption # Configure module access policies for Field Encryption {#ariaid-title1} * Freigeben Version: Australia * * Aktualisiert 12. März 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 Minuten Lesedauer Create a module access policy to control which users, scripts, or system processes can encrypt or decrypt data encrypted by a field encryption module. ## Vorbereitungen Role required: security_admin and sn_kmf.cryptographic_manager or sn_kmf.admin You must have a published field encryption module to use this process. If you have not done so, see [Configure Field Encryption modules](https://servicenow-prod.fluidtopics.net/KgQtmTCEjA1_hC9IWbpg9A "Learn how to configure Field Encryption modules."). ## Warum und wann dieser Vorgang ausgeführt wird Module access policies (MAPs) are the access controls you apply to your field encryption modules to define which users, scripts, or system processes can encrypt or decrypt data. Configure MAPs for users (via roles), scripts, or processes running in the "system" context. Without a MAP, users, scripts, or system processes aren't able to encrypt or decrypt data, which can result in end-to-end workflow processes not working correctly. MAPs are separate from access control lists (ACL), but can be used in combination with them. See [Exploring Field Encryption](https://servicenow-prod.fluidtopics.net/68IFYrnoYQyHc3F9qmk2Zg "Learn the details of Field Encryption Starter and Field Encryption Enterprise") for more information about the purpose behind MAPs. For Field Encryption Enterprise, review to plan for which users, scripts, or system processes need a MAP. ## Prozedur 1. Navigate to AllSystem SecurityField EncryptionField Encryption Experience. 2. Select Access Policieswithin the module's tile. 3. In the Module Access Policy form, fill in the fields as needed. {#maps-for-fe__table_wyr_rgm_f2c__entry__2} | Field | Description | |-|-| | Policy Name | Name of your MAP | | Type | Decide who or what should have access to this MAP to encrypt or decrypt data. Scope : Anything within the specified Application Scope has access to this MAP. Role : Only users with the specific role can access this MAP. Script : Ensure a specified script can access this MAP. System Access : Allows processes running in "System Context" access to this MAP. Resource Exchange : Allows for the Resource Exchange feature access to this MAP. For more information on how these different types of MAP work, see [Exploring Field Encryption](https://servicenow-prod.fluidtopics.net/68IFYrnoYQyHc3F9qmk2Zg "Learn the details of Field Encryption Starter and Field Encryption Enterprise"). | | Result | Select one of the following: Track : Permits access and monitors use of the MAP. Reject : Rejects access unless a different MAP grants access. StrictReject : Rejects access under all circumstances, even if a different MAP grants access. | | Crypto Module | Select the field encryption module to be governed by this MAP. | | Crypto Spec | Optional. Select or create a new Cryptographic Specification for this MAP. This field appears only when the Specify Purpose field is enabled. | | Active | Enable to activate this MAP. | | Target Scope | Select a scope to that this MAP applies to. This field appears only if the Type field is set to Scope. | | Target Role | Select which role should have access to this MAP. This field appears only when the Type field is set to Role | | Target Script | Choose the specific script of the type table selected in the Script Table field that should have access to this MAP. This field appears only if the Type field is set to Script. | | Approval Type | Select either One Time or Recurring: One Time : Allows for the symmetric data encryption key in the associated field encryption module to be securely shared to the target instance one time. Recurring : Allows for the symmetric data encryption key in the associated field encryption module to be securely shared to the target instance on a recurring basis. This field appears only if the Type field is set to Resource Exchange. | | Target Instance Host | Enter the URL for the target instance that the symmetric data encryption key in the associated field encryption module is being sent to. This field appears only if the Type field is set to Resource Exchange. | | Specify Purpose | Optional. Enable to display the Crypto Spec field on the form. Enable this option to configure granular operations, such as some users being able to encrypt, but not decrypt. | | Granular Operation | Optional. Select the cryptographic purpose for the Crypto Spec. The values available depend upon the type of Crypto Spec that is selected. For example, you can specify that this MAP only allows users to encrypt, but not decrypt, or the opposite, or both. This field appears only if there's a value in the Crypto Spec field. * If a user has encrypt access, but not decrypt access, the field displays in edit mode and the data entered displays as asterisks. * If a user has decrypt access, but not encrypt access, the field displays the decrypted data in read-only mode. * If a user has encrypt and decrypt access, both read and write functionality are available for the encrypted field. {#maps-for-fe__ul_cht_s3m_f2c} | | Script Table | Select which type of script applies to this MAP: * Access Control * Activity Designer * Business Rule * Inbound Email Action * Record Producer * Scheduled Script Execution * Script Include * UI Action * Widget * Workflow Activity {#maps-for-fe__ul_m5k_pkm_f2c} This field appears only if the Type field is set to Script. | | Check Script Version | When selected, the system checks the version of the script that is run with the version specified in the Target Script field. If the versions are different, the admin is notified. This field appears only if the Type field is set to Script. | | Impersonation | When enabled, a user impersonating another user gains any MAP permissions from both users. If disabled, a user impersonating another user only has any MAP permissions that were granted to them from before the impersonation. | [ ] {#maps-for-fe__table_wyr_rgm_f2c} 4. Select Submit.