Review ACLs — example output

███╗ ██╗ ██████╗ ██╗ ██╗ █████╗ ██╗ ██╗ ██╗██╗████████╗ ████╗ ██║██╔═══██╗██║ ██║ ██╔══██╗██║ ██║ ██╔╝██║╚══██╔══╝ ██╔██╗██║██║ ██║██║ █╗ ██║ ███████║██║ █████╔╝ ██║ ██║ ██║╚████║██║ ██║██║███╗██║ ██╔══██║██║ ██╔═██╗ ██║ ██║ ██║ ╚███║╚██████╔╝╚███╔███╔╝ ██║ ██║██║ ██║ ██╗██║ ██║ ╚═╝ ╚══╝ ╚═════╝ ╚══╝╚══╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ✦ NowAIKit — The #1 AI App for ServiceNow - Running review-acls in direct mode (ollama)... # ACL Coverage Analysis Report ## Instance: demo2 Analysis Date: 2025-06-17 Analyst: NowAIKit Scope: Instance-wide ACL coverage across all tables --- ## ⚠️ Data Availability Notice The data provided indicates "Here is the data gathered from the ServiceNow instance:" but **no actual ACL records, tabl✔ Capability completed (0 data points gathered) # 🛡️ ServiceNow ACL Coverage Analysis Report Instance: demo2 Analysis Scope: Instance-wide (all tables) Status: Data pending — Generating sample analysis framework --- ## ⚠️ Data Status Notice The provided data appears to be empty. To perform an actual ACL coverage analysis, I would need: 1. ACL records (from `sys_security_acl`) 2. ACL conditions (from `sys_security_acl_group`) 3. Table metadata (from `sys_db_object`) 4. Field definitions (from `sys_db_field`) 5. User role assignments (from `sys_user_gr` + `sys_security_acl_group`) --- ## 📋 Sample Coverage Matrix (Expected Output) Below is what a complete ACL coverage analysis would look like once data is received: | Table | Read | Create | Write | Delete | Field-Level | Row-Level | Issues | |-------|------|--------|-------|--------|-------------|-----------|--------| | **sys_user** | ✅ | ✅ | ✅ | ✅ | ❌ | ⚠️ | Missing field ACLs for `user_password` | | **sys_user_questionnaire** | ✅ | ❌ | ❌ | ❌ | ✅ | ✅ | None | | **incident** | ✅ | ✅ | ✅ | ✅ | ❌ | ⚠️ | Missing department-level row ACLs | | **problem** | ✅ | ✅ | ✅ | ❌ | ✅ | ⚠️ | Delete ACL missing | | **change** | ⚠️ | ✅ | ✅ | ❌ | ❌ | ⚠️ | Overly permissive read ACL | | **cmdb_ci_server** | ✅ | ✅ | ✅ | ✅ | ❌ | ❌ | No tenant separation | | **sc_task** | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ | None | | **custom_hr_employee** | ✅ | ✅ | ✅ | ✅ | ❌ | ❌ | Critical: Custom table with no ACLs | | **custom_payment_info** | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | Critical: No field ACLs on sensitive data | | **attachment** | ✅ | ✅ | ✅ | ✅ | ❌ | ⚠️ | No ACL on sensitive files | --- ## 🔍 Gap List (Sample Findings) | Severity | Table | Gap Type | Details | Recommendation | |----------|-------|----------|---------|----------------| | Critical | custom_hr_employee | Missing ACL | Custom table with zero ACL records | Create table-level ACL with scoped role `hr_admin` + default admin | | Critical | custom_payment_info | Missing Field ACL | Field `card_number` contains encrypted PII | Add field-level ACL with condition `gs.hasRole('hr_admin') && !current.company == current.company` | | High | incident | Row-Level | No company/department separation | Add row-level condition: `current.department == current.department` | | High | sys_user | Field ACL | `user_password` field accessible to all | Deny all except admin with condition `current.password` | | Medium | change | Overly Permissive | Read ACL uses `*` operation | Split into separate ACLs per operation (read, write, delete) | | Medium | cmdb_ci_server | Row-Level | No domain separation | Add domain condition: `gs.hasDomainAccess()` | | Medium | sys_registry | Admin-Only | Write ACL only requires `admin` | Replace with scoped role `admin_write` | | Low | task | Admin-Shortcut | All write ACLs use `admin` role | Convert to scoped role `task_writer` | --- ## 📌 Recommendations (Prioritized) ### 🔴 Critical Actions 1. Add ACLs to Custom Tables - Create table-level ACLs for all custom tables without ACL records - Use scoped roles instead of `admin` requirement 2. Implement Field-Level ACLs - Add field-level ACLs for sensitive fields: `password`, `card_number`, `ssn`, `api_key` - Deny by default, grant explicitly 3. Add Row-Level Separation - Implement company/department/assignment_group conditions - Restrict visibility to records within user's organizational scope ### 🟠 High Priority 1. Remove Wildcard ACLs - Audit ACLs using `*` operation type - Split into granular read/write/delete ACLs 2. Simplify Script Conditions - Convert `gs.hasRole()` script conditions to role field references - Replace simple field comparisons with condition builder expressions 3. Address Conflict Risks - Identify overlapping ACLs that may conflict - Ensure restrictive ACLs are evaluated after permissive ones ### 🟢 Medium Priority 1. Replace Admin-Only Requirements - Create scoped roles for common tasks (e.g., `x_change_writer`) - Document role requirements per table ... (277 more lines — full output truncated for screenshot)