welcome everyone uh to our last platform Academy for 2022. it's been exciting uh one and a half years since I started this series and I'm very much looking forward to next year already uh for today we have a special uh session um about securing uh your records in service now my name is Lisa hornstein I'm a product manager for the now platform focusing on workflow automation mostly um I am coming up on my four year anniversary ad servicenow I've been working with the now platform for about six and a half almost seven years now uh with me are my my uh very lovely colleagues Jared and Paige I will hand it over to you and please uh introduce yourselves and then take us into our topic for today thank you for having us Lisa I'm Jared Mont a product success manager here at servicenow and over the past eight years I've been doing a variety of system internals security Integrations and things like that and currently focusing on the core platform and mostly data security and privacy products that we offer all right I guess that's me uh so I am Paige Duffy I'm also a principal product success manager here at servicenow I've been on the platform for about 12 years in joined service now six months ago in that time I have been in numerous roles as a developer a platform owner Etc um here at servicenow I focus primarily on app engine and then the development or creation of custom apps it sounded like you had numerous roles in your six months at service now and no thankfully only one awesome um so everybody please uh put your questions in the Q a panel as always the session is being recorded I will edit it and upload to Youtube next week so if you find your colleagues would benefit from this knowledge and I'm sure they will uh please forward the link um I will put the um recording in the community post that you uh clicked on to get here so uh all right securing records what do we need to do quick before we dive in on housekeeping Safe Harbor most of the stuff we're going to be talking about during this time uh has been around in the platform for a decade or so it's not brand new but just in case we do mention new technologies um this is unless it's in production don't use it for your purchasing and today uh let's look at uh some of the Technologies securing records specifically with ACLS but there's a variety of other things that we can use to do that and it's not just creating the ACLS it's you have to manage them after they're there you have to troubleshoot them uh you don't want to make any mistakes and cause pain for other parts of the platform so we'll get through all that in the next hour uh so again the scope of what we're looking at here today we're going to be looking for Access Control lists AKA ACLS AKA Ackles but there's a variety of other technologies that you can use to secure the records on the platform we're not going to go deep into them but they all kind of complement with each other to uh depending on on your companies or your industry's unique security needs one thing that's new in Tokyo that I love calling out is the data filtration plug-in it's a free plugin and unlike what we're talking about here today where acl's ad access the data filtration plugin actually lets you add in some deny rules and build conditions where people don't have access to tables or don't have access to certain records so definitely more to come on that in the future platform academies and then all the other things that you see on the screen here um we're not really going to go deep into those but they all exist as part of a well-balanced security program so uh at the end of the show we'll ask for some feedback about what you want to see next uh if there's anything we touch on that you want to see more on uh please reach out to Lisa and us so what's oh another important piece of housekeeping we um when you're adding ACLS you're modifying access for people uh it can have some licensing impacts um so please just be aware that uh you know an accident of adding right access to your entire org is technically adding fulfillers permissions to your entire org so uh just just be careful with that the good news is that subscription management is getting better and will help you um I don't know make sure you're aware of that and we were working on better we're working on tools of visibility but the first thing is just understand that that when you were adding access you were adding access ensure that you're I'll be aware what your entitlements are and that you're not giving access that you're not entitled to the second thing the right here is we do have two Academy sessions on subscription management uh one a general one and then the one about mapping custom tables uh with atoms so if you have questions about that check those out too absolutely so I think that's all the housekeeping of the day and gosh I'm doing a lot of talking so let's take a look at the some parts of the ACLS and Page let's uh jump into this oh I get to talk to you guys about all the wonderful bits and Bubbles within the ACLS um so so the fun part so just you know One initial point of conversation if you're modifying ACL is creating them deleting them you do need to elevate to security admin and we're going to talk about that special role a little bit later in the presentation but just so you're aware um as you can see on the slide there are 10 types of ACLS uh those are what you're actually targeting to give access to um those 10 types exist today in Tokyo it has not always been 10 types I think it was back in Jakarta or so there were only five um some of those come from the new ux experience but we're really focusing today on records it's important to know the others exist for other things that you may be doing but we're really going to dive into just that record type and then next up we have the operations that you can perform on that type this list does change a little bit based on the type that you pick but again since we're focusing on record um there are 13 options specifically for record and we're going to dive even deeper directly into the um create read write and delete types uh sorry operations um it's also known as crud if you ever hear that that's what they're talking about uh I remember in The Way Way Back times I was like crud that doesn't make sense there's a w um but W right update same thing uh some of those other types they focus around reporting or like list editing and so there are definitely some things that we're going to talk about today that can apply to those those other operations but all the diagrams and stuff that you see today they're really kind of focused on that create read write and delete I mean karate is easier to pronounce them it does does make for a nicer acronym but I'm I've admitted this before I'm really bad at acronyms so to see that acronym and then see and not match up with the words was very confusing for me but so the next part of that ACL Anatomy is the name um and over the next in the next slide we'll we'll look even deeper into this but this really identifies which resource that ACL is going to apply to and it's made up of two components the table name and the field name you have to have a table name sort of which you'll you'll see here in a minute you have to have something in that table named field you don't necessarily have to have something in the field name field and that table name field it can contain an asterisk actually either one of them can which is why I say you have to have something in there but it doesn't necessarily have to actually be a table name so if we move to the next slide you can see some high-level examples of this uh so the first one we have a star.star or asterisk.astric ACL and what that does is it allows access to all fields for which no either ACLS exist so if you have no ACL on your table and no parent table with an ACL then it will move keep moving up and move up to eventually to that star.star or Star ACL which is the next one the star ACL allows access to all records for which no other ACL exists um so the first one is for all Fields the second one is for all records next we have the table ACL so that's where you can grant access to all records on a table a specific table and then the table dot star ACL which um grants access to all fields on the table or the table dot field ACL which grants access to all to a specific field on a specific table so as you move down that list you get more specific the top is very generalized access to everything in the bottom is you have access to this very specific field and all three of those parts of the anatomy of the ACL kind of work together to to determine what level of access that you get um and then as we kind of move into the next part it's how they evaluate all right this is really the meat of how it all comes together and I'm very worried I'm going to stumble over this a lot it's hard to explain so if you if you have any questions about what I'm saying please ask them and I will try my best to um to you know stop and pause and and dive into that yeah and some of the stuff we've added saying the same thing three different ways um in in the next 20 slides or so just to really highlight yeah there's the same there's the same three or four pieces but uh it is consistently evaluated depending on how you set it up the next couple of images what as well they exist on the docs they're somewhat a little bit different than what I've put together here um there were some changes made based on additional information we wanted to add but the the basic structure is there in the docs as well if you find these images useful and they'll be in the PowerPoint as well um but basically the the way we start is obviously the user requests access to a record object um and when that happens the system starts to look for any matching ACL rules and so this is at a very high level um just looking for matches to the ACLS it's not even necessarily how they evaluate the ACL itself we're just looking for any ACLS that match so the very first thing it's going to look for is it's going to look for any ACLS that match at a table level if it finds any ACLS that match at a table level then you'll move on to evaluating the ACL permissions which we'll look at in a second if there aren't any that are found it technically moves into looking for any matching field level ACLs there's a caveat to that though out of the box now we do technically have an ACL that lives at the Star level that denies access and that's that's the lovely little asterisk for the asterisk at the side um so while this is a this is technically true in the diagram because we have those existing ACLS and we have the default deny model for our ACLS if you want to make a field level ACL on a new table and there were no other ACLS that existed for that table you would not necessarily have read or write access for that role um so definitely don't go yeah do you know if this default deny is default excluded for admins it is not for admins admins are the Star level ACL on that so yes admins are the the special the special we get permission to everything roll um so thank you yes that's excluded so all of that kept in mind um if there are no matches found technically it moves onto the field level or column level ACLS same thing is true if it finds any table level ACLS it'll evaluate evaluate those permissions if it passes it will start looking for field and column level ACLS if it fails at the table level it will deny access um so it only moves on to that next row if it either passes or there are no matches uh and then from there of course as you can see in the diagram it it evaluates at you know the field level sorry the table dot field level the parent table dot field level the asterisk dot field level those are evaluated in the order that you see on the screen um and once again if any matches are found we evaluate the ACL permissions if no matches are found then it automatically grants permission now again we go back to that same caveat if they don't have table level permission and because we have that default out of the box table level ACL that only allows admins um they won't be able to see anything but if they do have table level permission and they don't have individual field level permission that's okay it will proceed as long as there are no ACLS that you know exist to prevent that access um but again if you fail either of those checks your denied access to the object all right I think you did a wonderful job to explain that it's hard to explain I bet I agree I agree and so this so hypothetically let's take let's look at one where yes you got access to the table and let's say on short description there are um three field level ACLS and so for the first field level ACL you evaluate and it fails so then we'll loop back and look at the second field level ACL to see if if it per if it works uh if you meet the criteria and if the second one passes then we get the thumbs up and we don't even spend the the CPU Cycles evaluating that third field level ACL is that is that accurate is that a good way of of saying that yeah and you will actually see see that in the next diagram too and we go a little bit more in depth into how the ACLS evaluate it shows that Loop um and then in two slides you'll be talking about how what order those run in so next one and so this is the one that will look different than like really look different than what you see out on the docks and it's because we have added in that Loop that Jared was just talking about um so towards the top it's kind of the same the user requests access to the object that find ACL rules matching object that's that diagram we just looked at and then we start to evaluate and it again it evaluates in the order that you see does the user have any of the required roles yes or there are no required roles that it moves on to the condition does the you is the um is the condition true yes or there is no condition it moves on to the script um if you pass all three of those then you get access to the object if you don't then it determines whether or not there are any other ACLS to evaluate and if there are we start to Loop over again and it's really important on the screen to note that true or yes can also be blank so if there's nothing that exists there that that evaluates to true so if you had an ACL for a table and the entire thing was blank it will evaluate true which we'll talk about a little bit more um it's not necessarily a good thing don't don't don't do that but it does work that way so just be aware um and then I think next if there are no questions on this particular screen there is a question in chat to ask about deny ACLS so I would think this is in in this uh diagram for the does the script return true or does the is the condition true like the deny ACL would be if either of those those is false right sorry um yes it's always it's a hard one for me because we're we're saying at a high level that it's by default deny if you don't have an ACL that's explicitly granting access then it's denied um so kind of yes but you're not going to create an ACL that says ITIL does not have access to this you're going to create an ACL that says role one does have access to this and by nature of that ACL ITIL will not have access unless you explicitly Grant it uh so maybe a better way to think of this uh is what Jared mentioned earlier if you want to deny certain things you would use data filtration if you want to deny access to records because most grants access yeah ACLS are all adding access once you have access from ACL number two ACL number five cannot take that away from you so to really deny access to somebody you would have to go through every ACL and not find a match and there's a little bit of a Nuance there if you really wanted to make sure that it never evaluate it true for anyone or certain situations there are some special roles we'll talk about um in in five slides or so from now but uh yeah just one of the one of the things to remember is it when we're talking about ACLS they all add access so if if you have access added like through the ITIL role um another layer of ACLS will not remove that unless it's on a lower child table and it's masking the parent ACL one day there there are some caveats that but if you're working all on the same table and the ACLS are all on the same table then that is correct thank you sorry all right let me let me cause more confusion um no that's that's actually one of my my top points that I wanted to make sure that we said today was uh keep these things simple keep them don't don't try and get too clever in a script block and and because uh later on somebody's going to have to read through these uh potentially debug it potentially add to it and we don't want to have to have to do a web of of debugging and a quick quick story I really like this slide because uh a few years ago when I understood the basics of ACLS and I was on implementation projects debugging ACLs I didn't know how to explain it to other people but I knew that it kind of worked it worked consistently and every time that I was sure that I found a bug in servicenow system right I'm like I have this set up properly there's you know I'm not wrong the platform is wrong type of thing another 10 minutes of looking and I discovered I had made a mistake that the ACL evaluation was doing its job properly and so uh I guess that's that's one of my tips is uh this has been part of the platform for forever almost probably probably since 2004 so um it's it's pretty stable at this point um and I haven't haven't ever seen a bug in how this stuff processes but are we ready to move on over into uh optimizing yes I think so yeah cool cool and so while we have the evaluation still up on the screen before we pivot into optimization just look at at how this flows and so this is all being done uh server side code tons of times like like thousands of times uh picture a list view uh with 50 records in it and you're displaying 10 uh columns in your list view this is looping uh it's it's evaluating this uh when you're making the request it's evaluating it on every single row to determine can I show this field you know can I show the State field for this record to this user right now and it's it's evaluating this so many times behind the scenes so as we go into optimization uh there's some very specific ways that you can structure your ACLS to but be more efficient be to take advantage of how servicenow processes them behind the scenes how it uh evaluates them before your query after your query to make your users happy and reduce lag and um yeah so as we have in this first box uh the most efficient ACL from a processing perspective is one that has one or more roles but no condition and no script and so uh again because as you probably are aware uh your user session roles are cached uh and so when you're asking for the table it doesn't it doesn't have to go look and see what roles you personally have it just looks to see what roles the table uh requires across all the ACLS and if it finds a match great that's that's very efficient um second most efficient is one that has is a ACL again we're talking about a read or write or delete type of ACL has one or more roles and or or a condition um so I would I would think of this as as roles and a condition um and that's slightly that's that's better because there's no script to evaluate for every single record it's just a condition you know this this is this record a state equal closed okay then this ACL does not apply to me and that's again very quick um and and also the platform has some caching available to it to make that run faster for subsequent queries but we also want to keep the condition field simple right to not overload it and have giant constructions with ends and ORS and parentheses and all kinds of things in your conditions right absolutely yeah yeah rule number one of the day is ACLs add access they do not deny access rule number two is keep it simple that's that's a great call out Lisa uh all right third most efficient is going to be um has the second two are very similar uh has one or more roles or a condition and we're starting to use the script block the advanced checkbox on the on the record and we're scripting something uh it doesn't doesn't matter what we're scripting um even a simple answer equals true is still a script that has to be evaluated every time this record gets looked at um and and once we have a script block you know how powerful the platform is you can uh I even saw some internal docs that were joking around about uh only allowing access if it would reach out to the Twitter API and if you had not tweeted five times yet per day it would not allow you access but uh so you know the sky's the limit of what we can put into this script to block but be aware that that is server-side scripting um it will slow down uh the the execution of these um so great power great responsibility and all that so uh and then finally the the most um complicated but and and therefore slowest but also uh can be the most flexible for you uh if we have one or more roles and also a condition and also a script block uh so that's requiring the server-side logic to do evaluation on all three levels um and is no surprise going to be the slowest compared to these hyper fast ones over here on uh on the left side so uh if we look at how the platform caches this information uh if we don't use a condition block then it's it applies to every record on the table it doesn't care about what the state is or who the assignment group is as an example so we can just blanket give a a yes or no based on the the table level based off of a role so um that is super fast it is cached per session so um next time you go to uh back to a list view or when you go to the second page on a list view that particular ACL is very fast because it doesn't have to have to do every uh all the processing when we start adding a condition then that does get cached per record so if you load up a list of 20 things we've already evaluated all those records let's say you click into one of those records uh when we load up the form View that record level ACL processing has already taken place it's already cached um in in per record per session so uh the database can just go right to getting you the information and rendering the form we don't waste any time processing that ACL so if I were to navigate to a record directly by the direct link it would check the ACLS if I have not opened it in the list form before correct in that session yes yeah it will when we when we say cached it's there's a a cash check it'll say hey is this and I don't I don't know all the nuances of of how long the cash lasts but I do um doing research for this session uh did see that yes it's uh the table level is Cash per session until you know a period of time goes by or maybe yeah I don't want to speculate on on all those conditions but uh correct yeah if you if you see a link to a record in an email you click you click directly into that record um it will check to see is is there has there been ACLS rendered per cache um and uh if not then it will do the processing to evaluate those and um and that's why sometimes if you are looking at an email report or you get an email link and then you click on it and and occasionally it will say hey this record does not exist or this record you know uh is removed by security constraints and so that's you know that record exists but you are not allowed to see it I I would also add that if you're ever if you ever see something from a customer where they're like oh the first time I click into this list it's really slow to load but then the next time I go it's super fast I don't know what's going on it's only the first time that might be the problem um because once it's been run and it's cached it's going to run a lot faster but the next time they log in the next morning or whatever it's slow again so it's definitely something to look at if if you're seeing like a slow list load initially exactly and I have a couple tips on that in the debugging section later on uh and so you can probably guess where the next uh block is here because we're having to evaluate a script on every record or on every field on a record um the the caching system doesn't assume anything it just says nope this is scripted I'm going to evaluate that every time I look at it so we're not we're not getting any performance gains uh once we go into the world of scripting on our ACLs so that's not necessarily A Bad Thing uh sometimes we require the flexibility uh and granularity that the script block brings it up but in the conversation of caching uh we just don't get to take advantage of those speed gains and then uh one more reason is if you can if you can do some or most or all of your ACLS in a roll form with no condition and no script those also get evaluated before the database even begins uh query so if you say give me all the incidents it will do a quick ACL check the role-based ACL check and says do you even have permission to look at the incident table and if if you don't meet the requirements of at least one ACL based off of your roles then it doesn't even bother the uh spending any database Cycles retrieving that data for you it just says no thanks you don't have permission to that it just says no computer says no and yeah computers only do what we tell them to do and and in this case it's gonna It's Gonna Save processing on the database side um because it knows if you don't have a role you definitely don't have meet the requirements of a role in a condition and a script and so I'm not even going to bother with the record level query um so just another Pro for uh if if for some or most of your users you can squeeze them into uh ACLS that have uh that no condition and no script that's another optimization tip for you here and then everything else because condition right if we're saying you have access to things that are assigned to your particular assignment group or you have access to things that are work in progress but not closed and things like that that will have to be after the database is queried and after the system is looping uh per record to display it to you so that's that is a couple minutes on uh how you can make things run really fast all right what is next money out leading practices all right um so a couple of do's and don'ts um for a few of these we've got a couple of slides that expand on them so if this does not initially make sense to you hopefully cover it a little bit more um but first off uh restrictable first this is really the optimal way for a sales to run so if you can rest if you can restrict only based on role that's really the best way to do it um it's going to be the fastest ACL to run it's going to load your tables and your records faster than any other type of ACL um avoid or with scripted has rules which we'll see that here in just a second um kind of show you what that looks like and why it's bad practice and talk briefly about a better way to do it and if you have two or more ACLS with the same condition um and script but with different roles combine those into a single ACL and then just add both roles so that way it's only evaluating the ACL once against both roles but it's only running those conditions and scripts once uh next we have have matching read ACLS for existing right ACLS right ACLS can technically Grant you read access but you should really have those read ACLS existing regardless um because if for some reason you remove the right ACL well they're going to lose access to read as well and that may not actually be the outcome you're looking for and then lastly on the do's um use conditions instead of scripts if at all possible so I you know if we're looking at that optimization chart rolls first condition second scripts third um so try not to use scripts unless you have to uh we know what happens but also trying to minimize the number of times you have to use scripts um a couple of don'ts so don't create overly complex ACLS and I'll even expand on this a little bit and I would say not only a single ACL but a group of ACLS for a single table should not be overly complex so if you have 90 ACLS on a single table you might want to really look into what's going on there um that that complex logic it's going to have to run through a lot of those ACLS before it grants someone access and again that's not optimal additionally above and beyond it not being optimal it's also kind of a maintenance nightmare um in my past life we called it ACL spaghetti because it was difficult to maintain and it was difficult to figure out what was going on and debug and you know X person has access to this field but only when an incident is in this particular State and this was all on I mean it was just a nightmare to maintain and cleaning it up well great when we finally got to clean it up was also pretty terrible um next don't create open ACLS so like we saw earlier uh and have talked about earlier and we'll see you again here in a minute those ACLS that have no roles no conditions and no script at all that's an open ACL we don't want to do that and then lastly um don't create all-in-one multi-purpose ACL so don't try to create a scripted ACL that's you know trying to evaluate six different completely different conditions all within the script and don't do that again guilty of that guilty of that in the past with but luckily I've been through this webinar now and uh would not do that again and admittedly I have done most of these at some point in the last 12 years so you learn as you go what was the platform Academy 10 years ago that is a good question laughs um if you move to the next screen we'll look at a little more in depth into one of those so you know the avoid or with has roles as you can see in the bottom here and I have a sneaking suspicion that this is actually an out of the box ACL that's old as dirt but um as you can see on the first row it is using an ore condition with the has rolls in addition to evaluating against the current user is the owner of the current record you really don't want to do that this should really be two separate ACLS um which this is kind of repeated twice because we're making two different points but don't do that there's no reason to do that it would evaluate really slowly versus you know creating those two separate ACLS um if you had the separate ACL purchase those roles that's going to evaluate much faster and it's going to evaluate um before the database is queried and it's going to be catch so Bingo yeah and I we kind of touched on it a little bit before but um yeah I I am definitely guilty of trying to cram everything into a single ACL uh you know just to get the the story off my plates and move on but yeah in this case I would I agree break it into multiple ACLS probably even around personas right we could have one that's uh based off of a requester Persona like with that get user ID is the current society and then kind of a fulfiller or a licensed user all the others and that can help me organize them too and if you don't just think about fields and tables but who's the who's the personas behind or who actually needs access to those yep and there was a question which I think just merits talking about out loud which is if you have Mo and Daniel already answered it but I want to make sure people see this if you have multiple ACLS for the same thing same name if any one of them is Trooper access does servicenow evaluate all the ACLS or does it stop once you determine it determines you have access it stops once you to you it determines you have access so again when you're looking at optimization if you get access at the very first step it's not even going to evaluate the rest um so again as we're getting ready to move into debugging at least in my experience um I have seen where a specific group of users when they went to go load a list it was very very slow but another group of users that had the ITIL role it was very very fast and that would be because the ITIL role was just granting General access and so it was evaluating that first ACL and that was it but the other users it was evaluating a lot of other ACLS and there was some scripted stuff going on in there so it took a lot longer for that list to load um so ultimately it was still the ACLS that were the problem so if you want to move to the next one pattern [Laughter] um it's the pattern that I've messed up a lot in my life but I've learned a lot of good lessons here with others share with others uh so this is an example of an open ACL and as it states no role no condition no scripting that means everyone has access everyone would have access to this field on the stable um or to the table itself uh so again don't do that unless you really really mean to do it um which is likely rare that you really really mean to do it and at this point remember uh there's always licensing so if you give everybody access to a table this might be a problem with your licenses that is also true I see I see the open ACLS where I see those most commonly it's an accident it's always an accident but it's where I went to create a table and I went and it and I automatically created the ACLS and rather than um remove the ACLS I just deleted the roles it you need to make sure you go delete the ACL right in that process I've just seen people who didn't quite understand did you clear it out or not and when you test it all works so make sure when you're testing on your apps you test that people don't have access to yeah you test the reverse you're not just testing that they have access you're you're making sure the people who shouldn't be able to see it can't see it yeah that's a that's a good one great call out can you create an ACL without a role and if you can should you and Daniel's got it again um just to again repeat what he's saying he's saying you can and it just depends on the requirements um and you know thinking about your your end users so did we talk about snc internal and it once you have we will okay yeah that's a that's a good that's a good uh segue we'll come back to creating a sales without roles in the special role slide coming up there's just one more and it'll be quick because we've kind of already mentioned it and then Jared even got into further which is avoid combining you know those that Persona logic they request from color logic so again this is the same ACL we saw earlier it should really be two different you've got your your fulfiller type roles um you know that are scripted in there and then you know is the current user also the current owner of the record because this is on the user table so you know splitting up that that logic is smart and we can move on into special cases and debugging all right yeah I think we've touched on a couple of these things uh so this might not take as long but um if you've been in here editing a form we notice that admin override check box here um just says if you if you have the admin role I don't care what the rest of this ACL says I'll just evaluate as true but uh that's not a hundred percent accurate there are just a very few amount of exceptions to things that block the admin override box so things like if you see the nobody roll the security admin role or Mains roles if those are listed in the roles then the admin overrides will not take it will not give these admin access to that particular ACL the other option that's uh depending on how your scoped app is configured there's a scoped application application Administration mode that you can enable on the scope record itself if that is turned on and you have a admin role for your scope opted in and that is also part of the exclusion list and uh is is that what's happening in HR Service delivery that admins cannot see HR records unless there are also HR admins that is exactly what is preventing access security incident response HR uh or even your custom brand new scoped app um I'll evaluate the same way um again again it's not 100 the the scope has to be turned on into application Administration mode and there has to be at least one role that has uh that's that's flagged as the scoped app admin but those those are special rules um that you can see um yeah and we're familiar with security admin nobody is exactly what it means nobody will evaluate to that it's kind of the opposite of public and then maint is a a servicenow corporate role uh that allows support and product management to do things that um and just kind of a a special role that prevents admin from from getting access to things and I mentioned the other one public and that's a special role that will give access to uh even to even unauthenticated people uh so if you need to make a UI page a table or portal things uh accessible to even users that are not logged into your system that is where the public role comes in and that's a whole another webinar all on its own so I won't go too deep into that and then like Adam brought up the snc internal snc external roles there's a thing called the explicit roles plug-in that gets enabled on your instance as part of some I don't I don't think anyone installs it directly but it's it's baked into a few other major plugins that you may have installed on your instance and so when that plugin is installed it forces every sys user account to have at least one role and it will also Force every every ACL to have at least one roll so it helps prevent mistakes like what we saw earlier if you tried to save that record with no roles no conditions and no script it would slip the snc internal role into that ACL so again that's another uh thing we could go deeper on but we will stay away from that for today but just if you see these things that's where they're coming from and then on to I promise you some debugging uh tips in the past so like optimization there's a couple things uh the top two parts about debugging are how do I make it work as expected and hey this is really slow what can I you know what is making it slow so uh first thing like Paige's example before um it's it's fast for some people and slow for other people and you know I can I can prove that you know I impersonate this person and it's slow for me as well so yeah it's not just their computer or you know their network connection so slow ACLS we track those things behind the scenes so as an assistant admin you'll be able to go into the transaction log or the slow transactions tables and you'll be able to filter by table filter by date filter by users and things like that and you'll you'll see how long it took the AC L for you know for that record how long did it take to process all of the ACLS for this particular record for this particular transaction so you'll see that for records but you'll also see that for like script addressed apis and other types of things in in that table and then if you want to see an Aggregate and averages across all of your things that's where the slow transactions comes in and you'll see uh the total time uh you know how many how many milliseconds has all of the queries for today add it up to you and then also what's the average processing time those are in those tables and then what about things that are not working as expected uh there's a couple there's kind of the the older way and the newer way to debug what things are happening in your instance so the traditional way was the uh inline UI enable debug security it's a left bar option and then once you enable that you will start to see something that looks like this at the bottom of every list View and every form View and I could never read them I would try and I would always fail to understand them I don't know if I can zoom in here but we can see uh just a quick we're reading we can see that I'm looking for the uh for the ACL for UI page for incident underscore list for read and we see that I got green check box for the star UI page and then we move on to how about this in the uh incident to read and uh this is a screenshot so the hovers won't work but we can see that there's three box these these last three options are exactly what we were talking about earlier this the second line is uh did you meet the role requirement the second one did you meet the condition requirement and the third one is to meet the script requirement and and so to answer the the question to reiterate the uh Daniel's answer from earlier is yeah we got a yes on this first one so there's four other ACLS that could have applied but we're not even going to bother checking those because I got my yes on the record level so then we go into the uh read for incident.number and same sort of thing and then the blues indicate that this was a cached response so uh we see that that we got yes we got access to incident.number through the incident.star ACL and uh and so on and so on right we're still looking for uh so so that's the traditional way it will fill up your form View at the bottom and and the bottom your list view with lots of these things and uh the the newer way is bolted onto the new uh the script debugger script Tracer pop-up so if you enable that you'll get a similar looking view within uh your your script debugger pop-up and it gives you the same type of information but this can be helpful because it mixes this in uh if you have multiple types of things that you're logging everything is in line and one of the coolest features of this pop-up is notice that the evaluation time goes down to the thousandth of a second so everything is is in perfect order you can see when did my before query business rules run when did the ACLS run when did my before business my before business rules if we're trying to save a record uh and you have five different business rules that have a order of 100 this will let you know exactly you know which order they processed uh and it mixes in all the security information um in line so uh yeah so when we're trying to figure out why can I not see what I want to see or why are users not getting what they're supposed to these are the debugging tools um uh we had a couple of other examples queued up but I I think we kind of [Music] covered them well yeah I think we actually kind of covered those questions anyway and they'll still be part of the the PDF so um yeah yeah we'll share them on the deck and also in the community yeah yeah we did Cover these if you're scripting has a role it's it's basically the same thing but you're not going to be cached um and let's just yeah let's skip through these and get into this part yes and while the questions uh well questions may come in I will start the uh survey for this session and we would love for you to give us your feedback on how you like this and we'll open the floor up if there are any more questions around this foreign thank you to everyone that's submitted questions during the show it does it does help us make sure we're touching on the things that that you came here to hear yes absolutely um let's see if there are more questions coming in uh but in the meantime uh let me um wrap this up a little bit thank you so much Jared and Paige for uh preparing this presentation for us this was super interesting I learned a lot and I've been on the platform for over six years um I think this is a very very valuable um session for everyone whether you're a beginner or an expert there will be something in here for everyone to learn um so thank you again for for coming on my Academy for this um I'm very much looking forward to uh to bring this to everyone through YouTube um you've already put up those um slides the with the link to the academy uh this is the last session for 2022 uh we will pick up again on January 19th uh so we'll skip a couple of sessions in in the regular by week weekly Cadence but I look forward to see you again next year and we have some awesome uh sessions in our backlog we want to tackle a couple of Better Together stories uh in our next Academy sessions so combining different platform products to uh bring you even more value um if you use them together so not just looking at one one platform product um on its own but how it works together with different other products as well and we'll also have a new session on decision Builder early next year because there are some some great Innovations coming in the next releases so I'll be looking forward to that as well I would love for all of you not just to fill out the survey that we have right here and I've seen a lot of answers have come in but also to take a few minutes to answer questions about the academy me um Community articles so we want to know how you find your way in the new community portal and how how well you find the academy sessions and did you know there are more Academy sessions than just this one we do have a mobile Academy a virtual agent Academy we have a next experience academy one about AI one about um what did I forget process optimization there's more so be sure to also check out SN dot Works slash Academy to find all of the platform academies that we offer um and that's about all I have to say today at any rate I wish everybody lovely holidays uh thank you so much for joining us today thank you Jared and Paige for the session this was awesome and Merry Christmas I'll see you all next year thank you thank you everyone thank you bye-bye