Security and Restricting Access · Topic 4 of 4
Protecting Application Artifacts with Scope
ServiceNow CAD: protect app artifacts with scope, using Application Access settings, script include access, cross-scope privileges and protection policy.
- 4 min
- Scope protects against other applications; ACLs protect against users.
- New scoped tables default to All application scopes with only Can read.
- Script includes have Accessible from: All application scopes or This application scope only.
What it is
Application scope is the boundary around a scoped application's files: its tables, script includes, business rules and other artifacts. Every artifact carries the scope namespace, such as x_acme_travel, and the platform uses that ownership to decide what other applications may do with it.
Scope protects the application from other applications. ACLs protect data from users. Both apply at once, and a request must pass both.
How it works
Table Application Access settings
Each table has an Application Access section. A new table in a scoped application defaults to Accessible from All application scopes with only Can read selected.
| Setting | Effect |
|---|---|
| Accessible from | All application scopes, or This application scope only |
| Can read | Other scopes may read records (needed for the other operations) |
| Can create, Can update, Can delete | Other scopes may perform that operation |
| Allow configuration | Other scopes may create configuration records that change the table's behavior |
| Allow access to this table via web services | Web service APIs may reach the table |
With the default, another application's script can read your records but cannot change them. Setting This application scope only shuts other scopes out completely.
These settings are a ceiling. They limit what other applications may do, and the user running the script still needs to pass the table's ACLs.
Script include access
A script include has an Accessible from setting with the same two choices. With This application scope only, scripts in other applications cannot call it, so internal helper logic stays private.
When another scope does call it, the caller uses the full name with the namespace:
var util = new x_acme_travel.TravelUtils();
var total = util.getTripCost(current.sys_id);Keep internal helpers private and expose a small public script include for anything other applications need.
Cross-scope privileges
When a script in one scope uses a resource in another, the platform records a cross-scope privilege (table sys_scope_privilege). The calling application's Runtime access tracking setting decides what happens:
| Mode | Behavior |
|---|---|
| None | All cross-scope privileges are granted automatically at runtime |
| Tracking | Access is allowed and a privilege record with status Allowed is created |
| Enforcing | A privilege record with status Requested is created; access works only after an admin allows it |
Tracking is the default. An admin can review the privilege records and change their status. Privileges can never grant more than the target's Application Access settings allow.
Design time protection
Scope also protects artifacts while you build. Studio and the application picker show which application you are working in, and files are created in that application.
A file created while the application picker is set to Global belongs to Global, not to your application, so it is not packaged with the application. An artifact that belongs to a different application cannot be edited until you switch to that application.
Protection policy
Script includes and other script files have a Protection policy that applies on instances where the application is installed, not on the development instance.
| Policy | Effect where installed |
|---|---|
| None | Other developers can view and customize the script |
| Read-only | Script logic is visible but cannot be changed |
| Protected | Script logic is hidden from other developers |
How the exam asks about this
- "Other applications must not read the app's Expense table." Set the table's Accessible from to This application scope only.
- "Other apps should read records but never change them." Keep the default: All application scopes with only Can read.
- "Customers who install the app must not see the pricing logic." Set the script include's Protection policy to Protected.
What to remember for the exam
- Scope protects against other applications; ACLs protect against users.
- New scoped tables default to All application scopes with only Can read.
- Script includes have Accessible from: All application scopes or This application scope only.
- Callers from other scopes use the namespace, such as
new x_acme_travel.TravelUtils(). - Runtime access tracking: None, Tracking (default) or Enforcing; privileges live in sys_scope_privilege.
- Protection policy (Read-only or Protected) applies only where the application is installed.
Do not expect Application Access settings to stop a user. A user with the right role can still open the records through the app's own forms; only ACLs restrict users.
Common mistakes
Assuming a new table is private. By default other scopes can read it. Change Accessible from if the data must stay inside the app.
Building files with the picker on Global. They are not part of the scoped application and will be missing from the published version.
Expecting Protected to hide code on the development instance. The policy takes effect only where the application is installed.
Check yourself
What can another scope do with a new scoped table by default?
It can read the records but not create, update or delete them, because only Can read is selected.
How do you stop scripts in other applications from calling a script include?
Set its Accessible from field to This application scope only.
Where does a Protected protection policy take effect?
On instances where the application is installed, where the script logic is hidden from other developers.
Topic 4 of 4 in Security and Restricting Access
Test yourself on Security and Restricting Access
The full ServiceNow CAD question bank has 600 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ServiceNow. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.