Users, Groups, and Roles
Access control in ServiceNow is a layered model: users (records in sys_user), groups (sys_user_group), and roles (sys_user_role). Users gain roles directly or through group membership. ACLs (access control lists) then decide record- and field-level access based on roles, conditions, and scripts. Candidates must understand the difference between role-based access (coarse) and ACL-based access (fine-grained), and that ACLs evaluate in a specific order: table-level, then field-level, with the most specific match winning.
Know the special users: system (internal operations, bypasses ACLs), admin (has the admin role, which overrides most checks but not all - e.g., some ACLs explicitly exclude admin), and guest (unauthenticated). Understand impersonation (requires impersonator) and delegation (a user grants another user authority to act, configured via Delegates).
Traps: assuming group membership alone grants access without a role; assuming admin sees everything (some ACLs and domain separation block it); and confusing assignment groups (used for routing work) with user groups for access - they are the same table but serve different purposes. Another trap is forgetting that roles can be inherited through groups and that removing a user from a group removes inherited roles.
Rule of thumb: to grant a user access to a module, give them the role; to restrict a specific field, write a field-level ACL. Never rely on UI policies for security.