{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40315,"path":"platform-security/access-control/frequently-asked-questions.md","title":"Frequently Asked Questions","bundle":null,"doc_type":null,"release":"australia","body":"\n# Frequently Asked Questions\n\nFrequently asked questions while using Access Analyzer.\n\n## Evaluate Access\n\nThe following are frequently asked questions while using the Evaluate Access feature of Access Analyzer:\n\n\n
\n\nQuestions\n\n\n\nExplanation\n\n
\n\nHow to read the evaluation results displayed by the Access Analyzer?\n\n\n\nEach row represents an individual access control list \\(ACL\\). The sequence \\(\\#\\) in the results represents the order in which ACLs are evaluated. Status shows whether overall access is granted \\(passed\\) or denied \\(blocked\\).\n\n
\n\nHow are ACLs evaluated?\n\n\n\nAt a table level, ACLs are evaluated only for roles and security attributes. Conditions and scripts aren’t evaluated.\n\n Roles are evaluated first. If Roles are blocked, conditions and scripts are skipped. For more information, see [Configure an ACL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/access-control/t_CreateAnACLRule.md).\n\n
\n\nWhat are the legends in Access Analyzer?\n\n\n\nWhen Analyzing the access and permissions, legends are displayed as part of the evaluation process. The following are the legends:\n\n - \\[Passed\\] Access granted\n- \\[Blocked\\] Access denied\n- \\[Skipped\\] Didn’t evaluate\n- \\[Undefined\\] No rule found\n\n
\n\nWhat is the Alert icon in the Access results mean?\n\n\n\nAlert Icon in any status indicates the presence of a script in the ACL. Review highlighted ACLs to understand the final access. To know more about how these controls are evaluated and review the logic used to determine the access, see [Access Analyzer Debug logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/access-control/access-analyzer-logs.md).\n\n
\n\nWhat is **IAccesshandler**?\n\n\n\nAn internal system check using hidden source code on the platform. It’s a system security check that you can’t modify. **IAccessHandler** can grant or deny access to a resource without evaluating ACLs.\n\n If this **IAccessHandler** is ignored, then the ACLs are evaluated. For example, an **IAccessHandler** implementation is used for access checks on application resources such as read-only access.\n\n
\n\nWhat are data filters?\n\n\n\nData filters are a form of access control designed to work along with the existing Access Control rules \\(ACLs\\) on your instance.\n\n
\n\nWhat is an ACL rule?\n\n\n\nRules for access control lists \\(ACLs\\) restrict access to data by requiring users to pass a set of requirements before they can interact with it.\n\n
Time limited role assignments found for the user may impact results. You can review the time-limited roles assigned for the user here.\n\n## Compare user records\n\nThe following are frequently asked questions while using the Compare user record feature in Access Analyzer:\n\n|Questions|Explanation|\n|---------|-----------|\n|How to read the results on the Details tab?|The Details tab displays the metadata associated with user 1 and user 2|\n|How to grant a role to a user?|From the Roles tab, you can check the role that must be granted for the user and assign that role.|\n|How to add a user to a group?|From the Groups tab, you can check the group the user must be added and add the user to the group.|\n|What is Show differences only?|When you enable the **Show differences only** check box, only the roles or groups that are different between the user 1 and user 2 are shown.|\n\n## Compare user access\n\nThe following are frequently asked questions while using the Compare user access feature in Access Analyzer:\n\n\n
\n\nQuestions\n\n\n\nExplanation\n\n
\n\nHow to read the results on the access control comparison page?\n\n\n\nThe access control comparison page displays the evaluation states for different ACL operations.\n\n
\n\nWhat are the different evaluation states?\n\n\n\nEvaluation states include:\n\n - Passed\n- Blocked\n\n
\n\nWhat is **Show differences only**?\n\n\n\nWhen you enable the **Show differences only** check box, only the operation evaluation states that are different between the user 1 and user 2 are shown.\n\n
\n\nHow is the ACL operation evaluated?\n\n\n\nRules for access control lists \\(ACLs\\) restrict access to specific data by requiring users to pass a set of requirements before they can interact with it. Within an ACL, the following hierarchy is evaluated:\n\n - Role\n- Security Attribute\n- Condition\n- Script\n\n
\n\nHow to read the results shown on the **Role Hierarchy** page?\n\n\n\nThe **Role Hierarchy** page displays roles that are assigned to user 1 and user 2. If a user needs access to a certain operation, you can determine the necessary role and group assignments.\n\n
\n\nHow can I see the details of the user?\n\n\n\nYou can select the **User \\(node\\)** > **More actions** > **View user details** to know more about the user.\n\n
\n\nHow can I see the details of the role?\n\n\n\nYou can select the **Role \\(node\\)** > **More actions** > **View role details** to know more about the role.\n\n
\n\nHow can I see the details of the resources the role can access?\n\n\n\nYou can select the **Role \\(node\\)** > **More actions** > **View all resources that the role has access** to know the resources the role can access.\n\n
\n\nHow can I see the details of the group?\n\n\n\nYou can select the **Group \\(node\\)** > **More actions** > **View group details** to know more about the group.\n\n
"}}