Restricted caller access privilege settings

  • Release version: Yokohama
  • Updated January 30, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Restricted caller access privilege settings

    Restricted caller access privilege settings enable ServiceNow customers to control and monitor cross-scope access requests within the ServiceNow AI Platform. These settings define how one application scope or script can access resources, roles, business rules, UI actions, script includes, or events belonging to another application scope.

    Show full answer Show less

    The system automatically creates sysrestrictedcalleraccess records when cross-scope access attempts occur or when caller access is set to restriction or tracking. These records help track, approve, or deny access requests between application scopes, ensuring proper governance of inter-application interactions.

    Key Features

    • Cross-scope tracking: Monitor requests where one application or script tries to access resources or events in another scope, including system-to-target scope scenarios.
    • Access control: Approve or deny cross-scope access requests based on defined privilege settings.
    • Privilege setting combinations: Configure access controls using combinations of source and target scopes and resources. These include:
      • Scope-to-scope
      • Scope-to-target
      • Source-to-scope
      • Source-to-target
    • Flexible resource targeting: Define access at the level of entire application scopes or specific application resources.

    Activation and Configuration

    • Activate the Scoped Application Restricted Caller Access plugin (com.glide.scope.access.restrictedcaller) using an admin role.
    • Restricted caller access is enabled by default in applications like HR Service Delivery and Security Incident Response.
    • Enable the Restricted Caller Access system property in Workflow Studio for relevant access control.
    • Create and manage sysrestrictedcalleraccess records to define and enforce cross-scope access privileges, approve or deny requests, and secure application interactions.

    Benefits for ServiceNow Customers

    • Ensures secure and audited access between applications, protecting sensitive data and resources.
    • Provides granular control over how application scopes interact, supporting compliance and governance requirements.
    • Facilitates troubleshooting and management of cross-scope dependencies by tracking access requests.

    Define cross-scope access to an application, application resource (such as an access control role, a business rule, a UI action, or a script include), or event. You can even use these settings to allow or deny requests for access.

    Restricted caller access privilege settings overview

    Restricted caller access [sys_restricted_caller_access] records track cross-scope applications or scripts that request access to an application, application resource, or event in the ServiceNow AI Platform. The ServiceNow AI Platform creates sys_restricted_caller_access records when one of these actions occurs:

    • Caller access is set to Caller Restriction or Caller Tracking.
    • A cross-scope script attempts to access an application resource or event.
      Note:
      A system scope to target scope is an example of a cross-scope.

    You can use these records to do these tasks:

    • Track cross-scope requests for access to an application resource. You can use access requests to determine which applications need access to resources and data from other application scopes.
    • Approve or deny any cross-scope requests for access to application resources or events. For example, you can create a Restricted Caller Access record to allow access for all scope-to-scope requests.

    For more information, see Requested restricted caller access (RCA).

    Restricted caller access privilege setting combinations

    You can define various combinations of privilege settings for restricted caller access and specify whether access is allowed or restricted for each relationship. This process ensures that your application has the privileges to access the correct scope and not one you don't want to access. You can define various combinations of the following settings:
    Scope
    All application resources in a selected source or target scope. To learn more about application scopes, see Application scope.
    Source
    A specific application resource in a selected source scope.
    Target
    A specific application resource in a selected target scope.
    These restricted caller access privilege settings combinations include, but are not limited to following combinations:
    • Scope-to-scope
    • Scope-to-target
    • Source-to-scope
    • Source-to-target
    Note:
    For more information about these access setting combinations and to learn how to create each combination, see Set the application scope, application resource, and event access.

    Activating application restricted caller access

    You can activate application restricted caller access through one of the following methods:

    • Activate the Scoped Application Restricted Caller Access plugin (com.glide.scope.access.restricted_caller).
    • Request the HR Service Delivery or Security Incident Response applications. By default, restricted caller access is active in these applications.
    • Enable the Restricted Caller Access system property for Workflow Studio.

    For more information, see: Activate application restricted caller access.