What is the typical evaluation order for an ACL in ServiceNow?

• A. role, condition, script
• B. condition, role, script
• C. script, role, condition
• D. role, script, condition

Answer: (A)

When ServiceNow decides whether an ACL allows access, it follows a specific sequence: first verify that the user has all the roles required by the ACL; if any required role is missing, access is denied right away. If the roles check passes, the system evaluates the condition on the ACL. This is a boolean expression that can reference fields on the record and other context; if the condition is false, access is denied. If the condition is true (or if there is no condition), the system runs the script portion of the ACL. The script is a JavaScript snippet that returns true or false and can enforce additional logic like ownership, timing, or other complex rules. This order—role, then condition, then script—allows quick rejection of unauthorized users and only then applies more detailed checks.