What is true about a Script Include with a protection policy value of protected?

• A. The protection policy is applied only if the application is downloaded from the ServiceNow App Store
• B. The protection policy is applied automatically to all apps
• C. Protection policy has no effect on downloaded apps
• D. The protection policy is applied only if the app is hosted on a private repository

Answer: (A)

A protection policy on a Script Include is about controlling how widely that code can be used across apps. When it’s set to protected, the Script Include is meant to stay within its own app boundary, guarding its implementation from being relied on by unrelated apps. ServiceNow enforces this boundary primarily for apps that come from the ServiceNow App Store, so the policy is applied in that distribution scenario to protect both the app’s logic and the integrity of other apps in the store ecosystem.

In practice, this means an app downloaded from the App Store will have its protected Script Includes shielded from access by other store apps, preserving the app’s internal behavior. If an app is sourced from a private repository or developed entirely within your instance, the Store-based protection rule isn’t the same gating factor, so the behavior isn’t driven by the Store policy in the same way.

So the statement that the protection policy is applied only when the application is downloaded from the ServiceNow App Store best captures how this policy is enforced in typical scenarios.