{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40349,"path":"platform-security/access-control/using-evaluate-access.md","title":"Using Evaluate access","bundle":null,"doc_type":null,"release":"australia","body":"\n# Using Evaluate access\n\nAnalyze identities on the ServiceNow AI Platform instance.\n\n## Before you begin\n\nRole required: access\\_analyzer\\_admin\n\nThe following procedure describes the steps for accessing Evaluate access in the Access Analyzer and using its various features.\n\n**Note:** Access Analyzer is a ServiceNow Store product.\n\n## Procedure\n\n1. Navigate to **All** > **Access Analyzer** > **Analyze Permissions**.\n\n The Analyze access and permissions homepage is displayed.\n\n2. Select the **Evaluate access** tab.\n\n3. Select your criteria as follows:\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nAnalyze by \\*\n\n\n\nAnalyze access for a user, a role, or a group\n\n
\n\nSelect user \\*\n\n\n\nSpecify a user name to select from the list.\n\n
\n\nRule type \\*\n\n\n\nAnalyze access for the following:- Table\n- UI page\n- REST Endpoint\n- Client callable script include\n- AI agent\n- Agentic workflow\n\n\n
\n\nSelect table \\*\n\n\n\nSpecify a table name to select from the list.\n\n
\n\nSelect record\n\n\n\nSpecify a record name to select from the list.\n\n
\n\nSelect field\n\n\n\nSpecify a field name to select from the list.\n\n
4. Specify the description in the **Description** field.\n\n5. Select **Analyze permissions**.\n\n The access results for the user are displayed. Similarly you can analyze the permissions of a Group or Role for the following rule types:\n\n - Table \\(record\\)\n - Client callable scripts include\n - REST endpoints\n The access results are displayed.\n\n \\[Omitted image \"use-access-analyzer-results.png\"\\] Alt text: Access results\n\n The Access results table includes the following fields:\n\n\n
\n\nFields\n\n\n\nDescription\n\n
\n\nOperation\n\n\n\nThe type of operation that the user, group, or role can perform for the selected table, record, or field.\n\n
\n\nOverall Access\n\n\n\nResult of the overall access. The results are as follows:- \\[Passed\\] Access granted\n- \\[Blocked\\] Access denied\n- \\[Skipped\\] Didn’t evaluate\n- \\[Undefined\\] No rule found\n\n\n
\n\nACL\n\n\n\nWhether an ACL is defined for the selected operation.\n\n
\n\nAccess Handler\n\n\n\nAn internal system check using hidden source code on the platform. IAccessHandler can grant or deny access to a resource without evaluating ACLs. If IAccessHandler is ignored, then the ACLs are evaluated.\n\n
\n\nData filtration\n\n\n\nA data filter is a form of access control designed to work along with the existing Access Control rules \\(ACLs\\) on your instance.\n\n
\n\nExecution time\n\n\n\nThe time at which the access results were executed.\n\n
\n\nInsights\n\n\n\nMore information about the selected operation.\n\n
\n\nExecution ID\n\n\n\nA unique ID for each access result execution.\n\n
6. Select the Operation for more information about the ACL.\n\n For example, if you select **read**, the access control related to read is displayed.\n\n |Field|Description|\n |-----|-----------|\n |Name|Name of the ACL.|\n |Decision Type|Decision type configured for the ACL. **Allow access** or **Deny access**.|\n |Applies to condition|Whether the ACL is applied to a condition.|\n |ACL Applies to|Details about the resource the ACL is applied.|\n |Status|Status of the ACL or Access result.|\n |Required ACL Roles|Details of the role that is required to access the resource.|\n |Role|Status of the role. Passed, Skipped, or Blocked.|\n\n \\[Omitted image \"acl-details-for-user.png\"\\] Alt text: ACL Details\n\n\n"}}