{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":48996,"path":"servicenow-platform/service-catalog/t_ContrlAccessByCDGUOrLoc.md","title":"Restrict access","bundle":null,"doc_type":null,"release":"australia","body":"\n# Restrict access\n\nService Catalog enables an administrator to grant or deny access to a service catalog item or category by company, department, group, user, or location.\n\n## Before you begin\n\nRole required: admin\n\n## Procedure\n\n1.  Navigate to **All** > **Service Catalog** > **Maintain Items** or **Service Catalog** > **Maintain Categories**.\n\n2.  Open the relevant catalog item or category.\n\n3.  [Configure the form](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/configure-form-layout.md) to add the appropriate **Available** or **Not available** lists.\n\n    \\[Omitted image \"AccessControl.png\"\\] Alt text: access control\n\n4.  Add the companies, departments, groups, users, or locations to the appropriate list.\n\n5.  Click **Update**.\n\n\n**Parent Topic:**[Legacy service catalog access controls](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/servicenow-platform/service-catalog/c_LegcySrvcCatAccessCntrol.md)\n\n## Restrict access by role\n\nBy default, individual catalog items and categories do not have access restrictions.\n\n### Before you begin\n\nRole required: admin\n\n### About this task\n\nAdministrators can grant or deny access to a service catalog item or category based on role.\n\n### Procedure\n\n1.  Navigate to **All** > **Service Catalog** > **Maintain Items** or **Service Catalog** > **Maintain Categories**.\n\n2.  Open the relevant catalog item or category.\n\n3.  Add the required roles to the **Roles** field.\n\n    You can, if needed, [Configure the form](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/configure-form-layout.md) or change to **Default View** to see the **Roles** field.\n\n    \\[Omitted image \"RolesGranted.png\"\\] Alt text: roles granted\n\n\n## Restrict access by a script\n\nService Catalog enables you to control access to a service catalog item or category with a custom script.\n\n### Before you begin\n\nRole required: admin\n\n### Procedure\n\n1.  Navigate to **All** > **Service Catalog** > **Maintain Items** or **Service Catalog** > **Maintain Categories**.\n\n2.  Open the relevant catalog item or category.\n\n3.  [Configure the form](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/configure-form-layout.md) to add the **Entitlement Script** field.\n\n    \\[Omitted image \"EntitlementScript.png\"\\] Alt text: entitlement script\n\n4.  In the **Entitlement Script** field, enter the access control script.\n\n    Sample Scripts:\n\n    The following example script grants access to a catalog item named French Blackberry to users with a language of Fr \\(French\\):\n\n    ```\n    gs.log ( 'Running Entitlement script for French Blackberry' ) ;\n     \n     if (gs. getUser ( ). getLanguage ( ) == 'fr' ) \n        answer = true ; else \n        answer = false ;\n     \n    answer ;\n    ```\n\n    The following example script could be used to distinguish between two categories of users \\(one with full access and one with restricted access\\) on the catalog of services:\n\n    ```\n    var userid  = gs. getUserID ( ) ; var now_GR  = new GlideRecord ( 'sys_user' ) ; \n    now_GR. get ( 'sys_id' , userid ) ; \n     \n     if (now_GR. source )\n        answer = true ; else\n        answer = false ; \n     \n    answer ;\n    ```\n\n    Overriding Entitlement Scripts by Role\n\n    1.  Navigate to **Service Catalog** > **Properties**.\n    2.  Enter the roles for which to override the entitlement script \\(grant access\\) in the property List of roles \\(comma-separated\\) that can override normal entitlement checking inside the catalog. An itil role of \"itil\" means that the itil role can order any catalog item, even one protected by entitlement restrictions.\n\n"}}