foreign welcome to part four in this series of securing fields in servicenow in this video we are going to take a look at view rules view rules are a very easy way to restrict or determine which views list views and form views are displayed to the user when they look at a list or look at a form so let's take a look at some examples so let's come back to our example here of a car's record where we wanted to only display the pen field for cut admin users and not for regular users okay so at the moment I've got uh default view set up that is displaying it and I've actually gone ahead in advance and configured a separate users view here so if I switch to that same record but the pen field is hidden there okay so let me switch back to the default view here for the admin we go back to our regular user here it's the same record they can see the pin field because they're looking at the default view and at the moment uh they're they don't have the ability to change fuse for that you need the view changer role and at the moment this user does not have that role so the user The View that there that we show them or configure by default that's the one that they're stuck with okay so for this user we actually want to hide the the pin field here okay so how do we do that well as I said I've already gone ahead and configured to or one View for the form and one for the list and the difference for both of them is that the pin field is not displayed so you can see here the pin field is not there in the list and also in the form as we just saw before okay so once you've got that set up you can come now to create a new view rule um and script the condition here to evaluate whatever role that should be that the user should have or shouldn't have and in this case we've got a condition here to say if they do not have the car's admin role we are going to display the user's View by default as you can see here the device type is set to browser so we're only looking at the classic or the platform user interface there is separate configuration depending on if you're configuring a workspace or a service portal page or a mobile application we're only interested in the platform user interface here okay so once we do that we can activate this and save it and we'll shall look at the result for the admin again nothing will change because we're only interested in evaluating if the user didn't have the car's admin role so if I come back to my form here and just refresh for the default view nothing has changed and I still have the ability here to select the user's view where the pin is not displayed okay that's working just fine so if we go back to our cars user okay and let me just refresh the page here okay we can see now we're looking at the users view the pin is not there and because I don't have the view changer role I do not have the ability to change the view here I'm stuck with what the admin has configured if I did have the view change your role I would be able to change or we'll be able to see different views but not necessarily be able to change to that view all right so that is working uh just fine if I come to the list as well we'll also see the the users list or the user's view list here the pin is not there it's not present how about the record again in our previous two videos for client scripts and UI policies we saw that despite the fields not being displayed in the form they were still loaded they were still query during the database and they'll actually still present in the HTML code for the page so it means that we could still look at the source code for the page and View and even change the value of that field this here is not the case if you look at the source code for this page we won't find any hidden pin field here so if we go to the next uh import control here uh that's actually this is still the security code field there and after that there is nothing else okay so in other words we have determined using a view rule What fields are retrieved from the database so there's a little bit more secure than a client script and a UI policy however if I had the ability to change the layout of the form at the moment I don't I could actually still display the pin field if I come to my list we're looking at the user's view here and the pin field is not there however by default in the servicenow platform all users have the ability to personalize lists okay now you can change this if you want to but that's the default Behavior okay that means I have the ability here as a regular user to personalize this list and now look at that I can see the pin field and not only that I can put it in my own personalized list which means I can now see the value of that field so view rules are a little bit more secure perhaps as client scripts and UI policies especially on the form where you can really restrict What fields are queried from the database but again users still have the ability to to display any hidden fields in a list if they have that personalized list option available and that by default is granted to all users in the platform okay so thanks for watching this video stay tuned for the next video in this series where we really get to data security in the servicenow platform and that is using access control rules so stay tuned for that thanks for watching again see you next time