hi everyone in this video we're going to take a look at how to approach implementing Access Control list stories Access Control list can be inherently problematic and a lot of students really struggle with this topic one of the reasons is there are a lot of access controllers in any instance of servicenow you will find tens of thousands of them and they can also apply at different levels at the table level at the parent table level at the field level and at the individual record level as well and often you can have access control rules that may seemingly conflict with each other on these different levels but when students see an access control list story that they need to implement they often just go ahead and click on that new button and create a new Access Control rule but hey Padre slow down a second how do we approach the implementing any story in service now what's the first thing that we need to do that we need to know we need to know what currently exists in the platform how can you begin creating any new record any new configuration in the platform if you don't already know what you have right now and the same applies with access control rules so let's consider two stories that we're going to implement in this video both of them are related to each other the first one is as a service desk agent in other words someone with the ital role I need to be able to edit my incidents only in order to enforce strict cues and assignments let's say we have a lot of service desks a lot of teams a lot of Staff working as service desk agents and we need to enforce who can work on which of these incidents the second story is as a service desk manager in other words someone with the ITIL admin role I need to be able to work on any incident in order to manage escalations okay so let's find out what we have right now in our instance there are many different ways you can view access control rules you could go to the access control rules module and filter thousands and thousands of Records what I usually do is just go straight to the table a list or a form and then just come to the context menu here and then go to configure and rather than clicking on security rules because that will also show me what I have in the parent table as well if there are any so in this case it would show me the access controls in the task table but I just want to concentrate on what's in the incident table right now because that's where we really usually have to do our configuration so I'm going to go to table instead and now we'll go down to the related lists down the bottom here to see our ACLS and we've got a lot here 73 but we're only interested in a handful of them so we'll just quickly filter this list according to all those with the right operation and then also those that pertain to the entire table Okay so we've got four that we're interested in let's find out what each of them do or specifically what the conditions are in each of them okay so the first one here you need the incident rate role let's take a look at the second ACL this one here actually contains no role but it does contain some other conditions which stipulate that basically you need to be the caller or I've opened the incident in order to change it we'll take a look at the third one this one here actually contains the ital which is one of the access control rules that we will need to modify actually so let's keep that one in mind let's have a look at the third one or the fourth one rather and the last one and this one here says you need the incident comments right role so let's go back to the third roll so in other words we do not need to create a new Access Control rule we already have one here for the ITIL roll the only condition that we need to add here is the requirement that was in the story to say you can only modify instance that have been assigned to you so at the moment the only condition here is that they are open so we will need to add another condition here to say where the assigned to field is and here we can take advantage of this Dynamic filter operator here this is dynamic and then it will default to me there are some other options here as well but this will basically translate to the currently logged in user and that's it so if we update that we can test it out actually it won't quite work now let's find out so I'm currently logged in here as Beth Anglin she has the ITIL role and I've taken the liberty of logging out and logging back in again just to ensure that the access control rule change that I've made is now applied so if we were to open up this second incident here that is assigned to Beth she's got right access to it let's move on to the very first one actually that wasn't assigned to her oh she can change this one too do you know why let's go back to our ACLs so if you recall we had four ACLS and if you recall the very first one actually contained another role the SN incident right role so here you need a little bit of knowledge about the out of the box roles that come with itsm in servicenow and what this role does and what it's actually part of because this role is also included in the ital role so even though Beth shouldn't have right access according to according to the ITIL Access Control rule she does have right access through this Access Control rule so in other words we need to make the same modification here as we did to the itool access control rule so let's go ahead and do that let's add another condition the same one as we had before assigned to is me and update that and we'll test that again so again we're back as Beth England logged in actually logged out and logged back in again and let's again open up the incident that she was assigned to number five okay she's got right access so that that's good let's have a look at the third one which is actually assigned to someone else it's assigned to Carol and it's read only now and that's what we want so in other words we've successfully implemented that first story that first requirement to say that you can only work on your own incidents we didn't need to create any new access control rules because we already had access control rules there that gave us permission to do what we wanted to do we only needed to modify the condition on the records that we were permitted to change let's take a look at the second story now where you need the ITIL admin role to be able to work on any incident that you like so for this story we actually do need to create a new Access Control rule because all the access control rules that we currently have at the moment are for other roles or other conditions there's none there that is related to the ITIL admin role so here we need to create one so let's go ahead and do that in other words what we're doing is creating a new key to access the door to get through that door so we're going to create a new right Access Control rule for the entire incident table and this time we just need to specify the ITIL admin role to say or basically to assign that role a key to the table so let's save that and we'll go ahead and test that out for this demonstration I've logged in as another user Carol Coughlin she has both the ITIL role as well as the ITIL admin role so let's first of all open up one of the incidents that she is currently assigned this third one here that Beth wasn't able to change okay so she's able to work on that that's fine all right let's go to the second incident now the one assigned to Beth and she's able to change that as well so that's exactly what we want so just to sum up working with Access Control list can be a little bit tricky because there are a large volume of those records and again they can work at different levels but again like any requirement that you need to assess and work on and Implement in service now you need to make an assessment first of all of what you currently have in your instance and only then will you be able to determine if you need to create a new record or modify an existing one and with Access Control this it's no different so as we saw for the first story that we implemented we needed to modify existing access control rules because we already had one for the ital role so we just needed to modify the condition for the Second Story on the other hand we needed to create a new Access Control rule because we needed to have one for the itool admin role which we didn't currently have one for so I hope this video was helpful for you and good luck with your development [Music]