{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":41750,"path":"platform-security/platform-encryption/map-vis-concept.md","title":"Module access policy visualization","bundle":null,"doc_type":null,"release":"australia","body":"\n# Module access policy visualization\n\nUse module access policy visualization to view all relevant cryptographic module information on a single UI page.\n\n\\[Omitted image \"map-vis-ui-page.png\"\\] Alt text: Module access policy visualization UI page\n\nKey Management Framework admins and cryptographic managers can use the module access policy UI page to view all access control mechanisms related to a single cryptographic module. Use the information collected on this UI page to determine who has access to encrypted information on your instance.\n\nUsers with the **sn\\_kmf.admin** or **sn\\_kmf.cryptographic\\_manager** roles can access the module access policy visualization UI page by navigating to **All** &gt; **Key Management** &gt; **Cryptographic Modules** &gt; **All**.\n\n## Results Labels\n\nModule access policies contain a **Result** field, which determines whether to grant access to the selected cryptographic module. The UI page displays a label on elements on the UI page based on the value of that field.\n\n|UI label|Result field value|Definition|\n|--------|------------------|----------|\n|\\[Omitted image \"map-vis-track.png\"\\] Alt text: Track label|**Track** or **Allow**|Access is granted to all users, including scripts.|\n|\\[Omitted image \"map-vis-reject.png\"\\] Alt text: Reject label|**Reject**|Access is denied unless a track module access policy is found.|\n|\\[Omitted image \"map-vis-strictreject.png\"\\] Alt text: StrictReject label|**StrictReject**|Access is denied.|\n|\\[Omitted image \"map-vis-absent.png\"\\] Alt text: Absent label|**N/A**|The module access policy doesn’t exist on the instance. Access is denied to all.|\n\n## Global policies\n\n<table id=\"table_hqc_p54_qxb\"><tbody><tr><td>\n\nUse the **Global policies** section to review the module access policies that control platform-level access.\n\n Select the **Manage** button below any of the policies to navigate to that policy record. If the policy doesn't exist, an **Add** button appears below that entry. Select the **Add** button to navigate to a new policy record where you can define the policy.\n\n</td><td>\n\n\\[Omitted image \"map-vis-global-section.png\"\\] Alt text: Global policies section\n\n</td></tr></tbody>\n</table>|Policy|Definition|\n|------|----------|\n|Default rule|The default rule policy defines the behavior when no existing rule matches an access request.|\n|Platform backend|The platform backend policy governs internal platform code access to cryptographic keys.|\n|Script engine|The script engine policy governs whether the script engine is permitted to access cryptographic keys.|\n|System user|The system user policy governs whether the system user is permitted to access cryptographic keys.|\n\n## Helpful resources\n\n<table id=\"table_hn2_gr4_qxb\"><tbody><tr><td>\n\nUse the **Helpful resources** section to find links to product documentation, relevant knowledge articles, and a brief description on how module access policies are evaluated on the platform. For a deeper look into how module access policies are evaluated, see [Module access policy debugger](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/platform-encryption/map-debugger.md).\n\n</td><td>\n\n\\[Omitted image \"map-vis-help.png\"\\] Alt text: Helpful resources section\n\n</td></tr></tbody>\n</table>## Granular policies\n\n<table id=\"table_j5n_js4_qxb\"><tbody><tr><td>\n\nUse the **Granular policies** section to view lists of module access policies, separated by policy type. Use the tabs above the list to select a policy category to display.\n\n -   Role\n-   Scope\n-   Scope and Domain \\(if Domain Separation is active\\)\n-   Script\n-   Resource exchange \\(if the cryptographic module is a Password2 or Field Encryption submodule\\)\n-   Identity \\(if Secrets Management Enterprise is active\\)\n\n By default, the each list displays only active policies. Use the filter icon to change the default filter for the list.\n\n</td><td>\n\n\\[Omitted image \"map-vis-granular.png\"\\] Alt text: Granular policies section\n\n</td></tr></tbody>\n</table>## Users with access\n\n<table id=\"table_btv_b54_qxb\"><tbody><tr><td>\n\nUse the **Users with access** section to see a list of all users that have access to the selected cryptographic module. The list is grouped by user, as single users can posses multiple roles that grant access to a cryptographic module.\n\n</td><td>\n\n\\[Omitted image \"map-vis-users.png\"\\] Alt text: Users with access section\n\n</td></tr></tbody>\n</table>**Parent Topic:**[Key Management Framework Reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/platform-encryption/understanding-kmf.md)\n\n**Related topics**  \n\n\n[Key Management Framework key life-cycle states]()\n\n[Roles installed with Key Management Framework]()\n\n[Module access policy debugger]()\n\n[Encryption and Key Management subscription bundle]()\n\n"}}