{"id":644550,"date":"2020-02-03T10:25:00","date_gmt":"2020-02-03T09:25:00","guid":{"rendered":"https:\/\/www.devoteam.com\/expert-view\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\/"},"modified":"2020-02-03T10:25:00","modified_gmt":"2020-02-03T09:25:00","slug":"servicenow-system-security-before-you-go-crazy-with-before-query-business-rule","status":"publish","type":"expert-view","link":"https:\/\/devoteam.info\/sk\/expert-view\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\/","title":{"rendered":"ServiceNow system security: Before you go crazy with \u201cbefore query Business rule\u201d"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\"><strong>What is a before query Business rule?<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Before query Business rule (<strong>qBR<\/strong>\u00a0from now on) is a special type of business rule in ServiceNow (<strong>SN<\/strong>\u00a0from now on) that is used when we want to limit which records can users access from a given table. While most of you would probably think that Contextual security Access control lists (<strong>ACLs<\/strong>\u00a0from now on) are the default way to go, there are some drawbacks that stem from the way SN is built. In this article, we will discuss what options we have to secure our records, and in which use cases they are fit for purpose.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Why do we need qBR?<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Historically, Contextual security ACLs were added to the SN system later than the table queries themselves, this results in some interesting conclusions.\u00a0 If we print out all user records like (sys_user.list), the records are first queried and\u00a0<strong>then\u00a0<\/strong>ACL rules are applied. If ACL then denies access to that record, instead of not displaying it on the list at all, you will see the \u201cSecurity constraints\u201d message:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"http:\/\/alps.devoteam.com\/wp-content\/uploads\/sites\/16\/2021\/05\/2020-01-31.png\" alt=\"\" class=\"wp-image-2435\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">This is very confusing for end-users and also degrades the user experience heavily in case this user is able to open only 5\/1000 records as the records cannot be reasonably ordered to display only the visible entries. The user has to click many times to view entries that are available to him. This is not the desired experience!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here comes the qBR for the rescue. It effectively allows us to apply a filter before the initial query happens, thus eliminating the \u201cSecurity constraints\u201d message if done right. In turn, this can also be used as a replacement for some ACL entities; it is even considered a best practice by SN organizations to use either qBR or ACL.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When you have a few SN implementations under your belt, you will realize that despite best practices, we sometimes just know better (I mean we know the even better way which is fit for use &amp; fit for purpose). It can be for example the SN platform must be secured not only from a normal user querying confidential records but also against an external user querying confidential records via API where qBR will not be applied, thus leaving a backdoor open for a person with malicious intents.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Coping with the most common qBR complication<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In one of my projects the security was not only doubled (e.g. both qBR and ACL required) and complex (many rules for access), but also very sensitive to performance as users were frequently querying a table with almost 100 000 records. I will keep the ACL performance optimization for a separate article and here we will only discuss the qBR challenge I\u2019ve faced and the possible solutions I\u2019ve tried. I will also say why they failed, when they would work and what ultimately secured the desired functionality.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Consider the following case \u2013 we are querying documents, and some of them are classified. The user is only able to see unclassified documents\u00a0and\u00a0where he is a deputy owner\u00a0or\u00a0documents, that he is a direct owner of. At first sight, this query is not easily achievable to produce in a GlideRecord as we are missing a \u2018master OR\u2019 operator in GlideRecord class.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>Let\u2019s describe it with pseudocode:<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>addQuery(classification == none);<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>addQuery(deputy_owner == me);<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>addMasterOrCondition(owner == me)<em>;<\/em>&nbsp;<\/code><em><code>\/\/<\/code>&nbsp;this GlideRecord class method does not really exist&nbsp;<\/em><em>\/\/ If we used standard addOrCondition() the or would be applied only to the last query statement, not to the whole query. Hence need a master OR which is not available. How easy would this be in a standard SQL query, right?<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So, what are our options? I\u2019ll start from the least plausible to the one, that actually worked:<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>1)<\/strong>\u00a0<strong>Creation of multiple list views with hardcoded filters<\/strong><\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">In case there are just two separate lists (one for my documents, the second for documents related to me + nonclassified) this is a feasible solution. Our use case however was more complex and would require about 5 of these list views which is not really user convenient.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>2)<\/strong>&nbsp;<strong>Using a system property \u2013&nbsp;<\/strong><strong><em>glide.security.ui.filter<\/em><\/strong><\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Not many people know that there is actually a system property that can single-handedly replace a qBR. It can be used either as a global system property or just a dictionary attribute (for a single table). This makes sure that ACLs are processed for each queried record before they are displayed. Sounds too good to be true, right? Yeah, there is a price to pay in terms of performance. Especially if there are more than just a few records on the table and the ACL\u2019s themselves are not really lightweight. Also do note that this property is not really documented and there might be more issues with it. Maybe that\u2019s why the SN organization is not really referencing it anywhere.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For the issue, we are now discussing this did not work. But in some other projects, this proved to be a fit-for-purpose solution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For more information, please follow this link:<a href=\"https:\/\/gist.github.com\/icerge\/ad7d7197c2ad1990c416d1383bbb4ffe\" target=\"_blank\" rel=\"noreferrer noopener\">&nbsp;https:\/\/gist.github.com\/icerge\/ad7d7197c2ad1990c416d1383bbb4ffe<\/a><\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>3)<\/strong>&nbsp;<strong>Using an encoded query in qBR<\/strong><\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Encoded queries are very easy to build in case we are looking for static values. They are still possible to implement if we need dynamic values. However, they are subject to known errors in case we use the \u2018master OR\u2019 condition featured in the encoded query builder.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s start with the easiest use case and finish with the known error limitation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3.1) Simple query with static values<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is the easiest scenario \u2013 you can build a query using the visual builder, then right-click and just paste it into your script.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The script would look like this:&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>var encodedQuery = \u2018active=true^priority=1^ORpriority=2\u2019;<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>current.addEncodedQuery(encodedQuery);<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is nice, simple and effective. But only for static use cases.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"http:\/\/alps.devoteam.com\/wp-content\/uploads\/sites\/16\/2021\/05\/Sni%CC%81mek-obrazovky-2019-11-26-v-9.11.36.png\" alt=\"\" class=\"wp-image-2428\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3.2) More complex query with dynamic values using the \u2018contains\u2019 operator<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If we want to have dynamic value (let\u2019s say the assignee can see the record + his manager and manager of his manager), it\u2019s a bit more complicated.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The script would look like this:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><code>var managers = randomScriptInclude.giveManagers();<\/code><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\/\/ imagine a function that returns an array with sys_id\u2019s of this user\u2019s employees etc.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><code>var encodedQuery = \u2018assigned_toLIKE\u2019 + managers;<\/code><\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\/\/ I replaced the \u2018aaa\u2019 with the \u2018+ managers\u2019, which contains a string of sys_id\u2019s<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>current.addEncodedQuery(encodedQuery);<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This way we can build most of the query in the query builder and just copy it. Add temporary values where we need dynamic values and then replace them in the script.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"http:\/\/alps.devoteam.com\/wp-content\/uploads\/sites\/16\/2021\/05\/unnamed.png\" alt=\"\" class=\"wp-image-2429\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3.3) Known error preventing the use of \u2018master OR\u2019 condition in qBR<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There actually IS a possibility to provide \u2018master OR\u2019 condition to a GlideRecord class. It is in encoded query; it looks like this:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"http:\/\/alps.devoteam.com\/wp-content\/uploads\/sites\/16\/2021\/05\/Sni%CC%81mek-obrazovky-2019-11-26-v-9.18.24.png\" alt=\"\" class=\"wp-image-2430\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">It\u2019s the top OR button that does the trick (it\u2019s slightly highlighted in this picture). This query can also be exported \u2013 in the query string the master OR element looks like this (the ^NQ):<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">assigned_toDYNAMIC90d1921e5f510100a9ad2572f2b477fe^priority=1<strong>^NQ<\/strong>priorityIN2,3,4,5<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, as always, it\u2019s not so easy. Using the master OR in qBR will cause incorrect records to open. E.g. you click on INC000001 in the incident list and INC000005 is opened instead. Too bad, this doesn\u2019t resolve our issue with \u2018master OR\u2019 condition.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For more details on this known error and the reason for the strange quirk when opening a record, please see the following link: <a href=\"https:\/\/hi.service-now.com\/kb_view.do?sysparm_article=KB0564887\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/hi.service-now.com\/kb_view.do?sysparm_article=KB0564887<\/a><\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>4)<\/strong>&nbsp;<strong>Propositional logic in queries and the final solution<\/strong><\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">A university course I nearly forgot finally proved to be able to secure the desired solution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It literally took only a few minutes of switching the order of conditions and we had a nice and clean piece of code. What I am presenting is a very simplified version<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We build a query where instead of master OR we use master AND<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>addQuery(deputy_owner == me);<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>addOrCondition(owner == me);<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\/\/ now we have our documents but without regard for classification<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>addQuery(classification = none); \/\/ this is our master AND condition<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>addOrCondition(owner == me);<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\/\/ again we can do additional filtering with addOrCondition,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Literally what I did, in the end, is just flip the logic upside down and separate the query statements into two segments.\u00a0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you did not study computer science OR law OR philosophy, you can just read up on this topic here:\u00a0<a href=\"http:\/\/ovid.cs.depaul.edu\/Classes\/CS202-S07\/handout1.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">http:\/\/ovid.cs.depaul.edu\/Classes\/CS202-S07\/handout1.pdf<\/a>\u00a0It really is quite useful in the long run!\u00a0<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>5)<\/strong>&nbsp;<strong>Conclusion<\/strong><\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Who doesn\u2019t love a challenge right? But it\u2019s always nice to find some guidance. This was my motivation for writing this article because when I was making the effort to meet the requirements of the project it was very hard to find any resources on my specific struggles. So if anyone else finds himself in a similar situation I hope you find this article and get some ideas about what can be done.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you read this all the way down here, thank you and bless you!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Should you have any questions, <a href=\"https:\/\/nplatform.devoteam.com\/get-in-touch\/\">get in touch<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>What is a before query Business rule? Before query Business rule (qBR\u00a0from now on) is a special type of business rule in ServiceNow (SN\u00a0from now on) that is used when we want to limit which records can users access from a given table. While most of you would probably think that Contextual security Access control [&hellip;]<\/p>\n","protected":false},"featured_media":0,"template":"","categories":[2645],"tags":[],"industry":[],"class_list":["post-644550","expert-view","type-expert-view","status-publish","hentry","category-servicenow-sk"],"acf":[],"cards":"\n\t<div class=\"single-post-card\">\n\n\t\t\n\n\t\t\n\t\t<div class=\"wp-block-group is-vertical is-layout-flex wp-container-core-group-is-layout-43282307 wp-block-group-is-layout-flex\">\n\t<p style=\"font-style:normal;font-weight:700\" class=\"has-link-color wp-elements-1 wp-block-lp-post-type has-text-color has-primary-color has-small-font-size\">Expert View<\/p>\n\n\t\t\n\t\t<h3 style=\"font-style:normal;font-weight:400\" class=\"wp-block-post-title has-base-font-size\"><a href=\"https:\/\/devoteam.info\/sk\/expert-view\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\/\" target=\"_self\" >ServiceNow system security: Before you go crazy with \u201cbefore query Business rule\u201d<\/a><\/h3><\/div>\n\t\t\n\t<\/div>\n\n","yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.4 (Yoast SEO v28.4) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>ServiceNow system security: Before you go crazy with \u201cbefore query Business rule\u201d | Devoteam<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/devoteam.info\/sk\/expert-view\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ServiceNow system security: Before you go crazy with \u201cbefore query Business rule\u201d\" \/>\n<meta property=\"og:description\" content=\"What is a before query Business rule? Before query Business rule (qBR\u00a0from now on) is a special type of business rule in ServiceNow (SN\u00a0from now on) that is used when we want to limit which records can users access from a given table. While most of you would probably think that Contextual security Access control [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/devoteam.info\/sk\/expert-view\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\/\" \/>\n<meta property=\"og:site_name\" content=\"Devoteam\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/sk\\\/expert-view\\\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\\\/\",\"url\":\"https:\\\/\\\/devoteam.info\\\/sk\\\/expert-view\\\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\\\/\",\"name\":\"ServiceNow system security: Before you go crazy with \u201cbefore query Business rule\u201d | Devoteam\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/sk\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/sk\\\/expert-view\\\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/sk\\\/expert-view\\\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\\\/#primaryimage\"},\"thumbnailUrl\":\"http:\\\/\\\/alps.devoteam.com\\\/wp-content\\\/uploads\\\/sites\\\/16\\\/2021\\\/05\\\/2020-01-31.png\",\"datePublished\":\"2020-02-03T09:25:00+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/devoteam.info\\\/sk\\\/expert-view\\\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\\\/#breadcrumb\"},\"inLanguage\":\"en-SK\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/devoteam.info\\\/sk\\\/expert-view\\\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-SK\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/sk\\\/expert-view\\\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\\\/#primaryimage\",\"url\":\"http:\\\/\\\/alps.devoteam.com\\\/wp-content\\\/uploads\\\/sites\\\/16\\\/2021\\\/05\\\/2020-01-31.png\",\"contentUrl\":\"http:\\\/\\\/alps.devoteam.com\\\/wp-content\\\/uploads\\\/sites\\\/16\\\/2021\\\/05\\\/2020-01-31.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/sk\\\/expert-view\\\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/devoteam.info\\\/sk\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Expert View\",\"item\":\"https:\\\/\\\/devoteam.info\\\/sk\\\/expert-view\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"ServiceNow system security: Before you go crazy with \u201cbefore query Business rule\u201d\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/devoteam.info\\\/sk\\\/#website\",\"url\":\"https:\\\/\\\/devoteam.info\\\/sk\\\/\",\"name\":\"Devoteam\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/devoteam.info\\\/sk\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-SK\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"ServiceNow system security: Before you go crazy with \u201cbefore query Business rule\u201d | Devoteam","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/devoteam.info\/sk\/expert-view\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\/","og_locale":"en_US","og_type":"article","og_title":"ServiceNow system security: Before you go crazy with \u201cbefore query Business rule\u201d","og_description":"What is a before query Business rule? Before query Business rule (qBR\u00a0from now on) is a special type of business rule in ServiceNow (SN\u00a0from now on) that is used when we want to limit which records can users access from a given table. While most of you would probably think that Contextual security Access control [&hellip;]","og_url":"https:\/\/devoteam.info\/sk\/expert-view\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\/","og_site_name":"Devoteam","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/devoteam.info\/sk\/expert-view\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\/","url":"https:\/\/devoteam.info\/sk\/expert-view\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\/","name":"ServiceNow system security: Before you go crazy with \u201cbefore query Business rule\u201d | Devoteam","isPartOf":{"@id":"https:\/\/devoteam.info\/sk\/#website"},"primaryImageOfPage":{"@id":"https:\/\/devoteam.info\/sk\/expert-view\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\/#primaryimage"},"image":{"@id":"https:\/\/devoteam.info\/sk\/expert-view\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\/#primaryimage"},"thumbnailUrl":"http:\/\/alps.devoteam.com\/wp-content\/uploads\/sites\/16\/2021\/05\/2020-01-31.png","datePublished":"2020-02-03T09:25:00+00:00","breadcrumb":{"@id":"https:\/\/devoteam.info\/sk\/expert-view\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\/#breadcrumb"},"inLanguage":"en-SK","potentialAction":[{"@type":"ReadAction","target":["https:\/\/devoteam.info\/sk\/expert-view\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\/"]}]},{"@type":"ImageObject","inLanguage":"en-SK","@id":"https:\/\/devoteam.info\/sk\/expert-view\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\/#primaryimage","url":"http:\/\/alps.devoteam.com\/wp-content\/uploads\/sites\/16\/2021\/05\/2020-01-31.png","contentUrl":"http:\/\/alps.devoteam.com\/wp-content\/uploads\/sites\/16\/2021\/05\/2020-01-31.png"},{"@type":"BreadcrumbList","@id":"https:\/\/devoteam.info\/sk\/expert-view\/servicenow-system-security-before-you-go-crazy-with-before-query-business-rule\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/devoteam.info\/sk\/"},{"@type":"ListItem","position":2,"name":"Expert View","item":"https:\/\/devoteam.info\/sk\/expert-view\/"},{"@type":"ListItem","position":3,"name":"ServiceNow system security: Before you go crazy with \u201cbefore query Business rule\u201d"}]},{"@type":"WebSite","@id":"https:\/\/devoteam.info\/sk\/#website","url":"https:\/\/devoteam.info\/sk\/","name":"Devoteam","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/devoteam.info\/sk\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-SK"}]}},"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"1536x1536":false,"2048x2048":false},"uagb_author_info":{"display_name":"akielin","author_link":"https:\/\/devoteam.info\/sk\/author\/"},"uagb_comment_info":0,"uagb_excerpt":"What is a before query Business rule? Before query Business rule (qBR\u00a0from now on) is a special type of business rule in ServiceNow (SN\u00a0from now on) that is used when we want to limit which records can users access from a given table. While most of you would probably think that Contextual security Access control&hellip;","_links":{"self":[{"href":"https:\/\/devoteam.info\/sk\/wp-json\/wp\/v2\/expert-view\/644550","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devoteam.info\/sk\/wp-json\/wp\/v2\/expert-view"}],"about":[{"href":"https:\/\/devoteam.info\/sk\/wp-json\/wp\/v2\/types\/expert-view"}],"version-history":[{"count":0,"href":"https:\/\/devoteam.info\/sk\/wp-json\/wp\/v2\/expert-view\/644550\/revisions"}],"wp:attachment":[{"href":"https:\/\/devoteam.info\/sk\/wp-json\/wp\/v2\/media?parent=644550"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devoteam.info\/sk\/wp-json\/wp\/v2\/categories?post=644550"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devoteam.info\/sk\/wp-json\/wp\/v2\/tags?post=644550"},{"taxonomy":"industry","embeddable":true,"href":"https:\/\/devoteam.info\/sk\/wp-json\/wp\/v2\/industry?post=644550"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}