Configuration Validation

Configuration Validation

Overview

Configuration validation is essential for maintaining quality and preventing errors in ServiceNow deployments. This skill teaches systematic approaches to validate catalog items, workflows, business rules, and other configurations before deployment.

• What problem does it solve? Catches configuration errors, missing dependencies, and broken references before they impact users or cause production issues
• Who should use this skill? Administrators, developers, and release managers responsible for quality assurance of ServiceNow configurations
• What are the expected outcomes? Validated configurations that work correctly, comprehensive error detection, and confidence in deployments

Prerequisites

• Required ServiceNow roles: admin or specific admin roles (catalog_admin, workflow_admin)
• Read access to configuration tables (sys_script, wf_workflow, sc_cat_item)
• Understanding of ServiceNow configuration types
• Related skills: admin/schema-discovery (helpful for understanding structures)

Procedure

Step 1: Identify Configuration Type

Determine what type of configuration you need to validate. Each type has different validation requirements.

Configuration Types and Tables:

Step 2: Catalog Item Validation

Validate catalog items for completeness, proper configuration, and working dependencies.

If using MCP tools:

Tool: SN-Validate-Configuration
Parameters:
  type: catalog_item
  sys_id: <catalog_item_sys_id>
  checks:
    - variables
    - workflows
    - pricing
    - approvals
    - fulfillment

If using REST API:

# Get catalog item details
GET /api/now/table/sc_cat_item/<sys_id>?sysparm_display_value=all

# Get associated variables
GET /api/now/table/item_option_new?sysparm_query=cat_item=<sys_id>&sysparm_fields=name,type,mandatory,reference,order

# Get associated workflows
GET /api/now/table/wf_workflow?sysparm_query=table=sc_req_item^published=true&sysparm_fields=name,sys_id

Catalog Item Validation Checklist:

Step 3: Variable Validation

Validate catalog variables for proper configuration and functionality.

If using MCP tools:

Tool: SN-Query-Table
Parameters:
  table_name: item_option_new
  query: cat_item=<catalog_item_sys_id>
  fields: name,question_text,type,mandatory,reference,order,variable_set

Variable Type Validation Rules:

Validate Variable Choices:

Tool: SN-Query-Table
Parameters:
  table_name: question_choice
  query: question=<variable_sys_id>
  fields: text,value,order

Decision Points:

• If type is 5 (Select Box) and no choices exist → Error: Missing choices
• If type is 8 (Reference) and reference table doesn't exist → Error: Invalid reference
• If mandatory=true but default_value is empty → Warning: Required field without default

Step 4: Workflow Validation

Validate workflows for completeness, proper transitions, and no dead-ends.

If using MCP tools:

Tool: SN-Validate-Configuration
Parameters:
  type: workflow
  sys_id: <workflow_sys_id>
  checks:
    - activities
    - transitions
    - conditions
    - end_states

If using REST API:

# Get workflow details
GET /api/now/table/wf_workflow/<sys_id>?sysparm_display_value=all

# Get workflow activities
GET /api/now/table/wf_activity?sysparm_query=workflow_version.workflow=<sys_id>&sysparm_fields=name,activity_definition,x,y

# Get workflow transitions
GET /api/now/table/wf_transition?sysparm_query=workflow_version.workflow=<sys_id>&sysparm_fields=from,to,condition

Workflow Validation Checklist:

Detect Orphan Activities:

Tool: SN-Query-Table
Parameters:
  table_name: wf_activity
  query: workflow_version.workflow=<sys_id>^activity_definition.name!=Begin
  fields: sys_id,name

# Then check each activity has incoming transition
Tool: SN-Query-Table
Parameters:
  table_name: wf_transition
  query: to=<activity_sys_id>
  fields: sys_id

Step 5: Business Rule Validation

Validate business rules for proper configuration, syntax, and performance considerations.

If using MCP tools:

Tool: SN-Validate-Configuration
Parameters:
  type: business_rule
  sys_id: <business_rule_sys_id>
  checks:
    - syntax
    - conditions
    - performance
    - scope

If using REST API:

# Get business rule details
GET /api/now/table/sys_script/<sys_id>?sysparm_fields=name,when,collection,active,script,filter_condition,order

Business Rule Validation Checklist:

Common Business Rule Anti-Patterns:

// ANTI-PATTERN 1: current.update() in before rule
// Causes infinite recursion
(function executeRule(current, previous) {
  current.priority = 1;
  current.update(); // BAD! Remove this line
})(current, previous);

// ANTI-PATTERN 2: Unnecessary GlideRecord in before rule
(function executeRule(current, previous) {
  var gr = new GlideRecord('incident');
  gr.get(current.sys_id);
  gr.priority = 1;
  gr.update(); // BAD! Just set current.priority = 1
})(current, previous);

// ANTI-PATTERN 3: No changes() check
(function executeRule(current, previous) {
  // Runs on every update even if priority didn't change
  notifyPriorityChange(current.priority);
})(current, previous);

// CORRECT: Check if field changed
(function executeRule(current, previous) {
  if (current.priority.changes()) {
    notifyPriorityChange(current.priority);
  }
})(current, previous);

Step 6: UI Policy Validation

Validate UI policies for proper configuration and action completeness.

If using MCP tools:

Tool: SN-Query-Table
Parameters:
  table_name: sys_ui_policy
  query: sys_id=<ui_policy_sys_id>
  fields: short_description,table,conditions,active,global,inherit

Get UI Policy Actions:

Tool: SN-Query-Table
Parameters:
  table_name: sys_ui_policy_action
  query: ui_policy=<ui_policy_sys_id>
  fields: field,mandatory,visible,disabled

UI Policy Validation Checklist:

Step 7: Script Include Validation

Validate script includes for proper configuration and accessibility.

If using MCP tools:

Tool: SN-Query-Table
Parameters:
  table_name: sys_script_include
  query: sys_id=<script_include_sys_id>
  fields: name,api_name,client_callable,access,active,script

Script Include Validation Checklist:

Step 8: ACL Validation

Validate Access Control Lists for proper security configuration.

If using MCP tools:

Tool: SN-Query-Table
Parameters:
  table_name: sys_security_acl
  query: name=incident
  fields: name,operation,type,active,condition,script,role

ACL Validation Checklist:

Step 9: Generate Validation Report

Compile all validation results into a comprehensive report.

Validation Report Template:

# Configuration Validation Report

## Summary
- Configuration: [Name]
- Type: [Catalog Item / Workflow / Business Rule]
- Date: [Date]
- Validator: [Name]

## Overall Status: [PASS / FAIL / WARNING]

## Detailed Findings

### Critical Issues (Must Fix)
1. [Issue description and remediation]
2. [Issue description and remediation]

### High Priority Issues (Should Fix)
1. [Issue description and remediation]

### Medium Priority Issues (Consider Fixing)
1. [Issue description and remediation]

### Low Priority Issues (Nice to Have)
1. [Issue description and remediation]

## Validation Details

### Component 1: [Name]
- Status: [PASS/FAIL]
- Checks Performed: [List]
- Issues Found: [List]

### Component 2: [Name]
- Status: [PASS/FAIL]
- Checks Performed: [List]
- Issues Found: [List]

## Recommendations
1. [Recommendation]
2. [Recommendation]

## Sign-off
- [ ] All critical issues resolved
- [ ] All high priority issues resolved or documented
- [ ] Configuration approved for deployment

Tool Usage

MCP Tools (Claude Code/Desktop)

REST API (ChatGPT/Other)

Native Tools (Claude Code)

Best Practices

• Validate Before Promotion: Always validate configurations before moving between instances
• Use Automated Validation: Implement automated validation in CI/CD pipelines
• Document Exceptions: Document any validation warnings that are accepted
• Test with Data: Validate using realistic test data, not empty records
• Cross-Reference Dependencies: Ensure all referenced objects exist in target environment
• Version Control: Keep validation reports with update set documentation
• ITIL Alignment: Include validation as part of change management process

Troubleshooting

Common Issue 1: Validation Returns False Positives

Symptom: Validation flags issues that work correctly in practice Cause: Validation logic doesn't account for all valid configurations Solution: Review the specific validation rule and add exception handling

# Check if the "error" is actually valid
Tool: SN-Query-Table
Parameters:
  table_name: <relevant_table>
  query: sys_id=<object_sys_id>
  display_value: all

Common Issue 2: Missing Dependencies in Target Instance

Symptom: Configuration works in dev but fails validation in test/prod Cause: Dependencies not included in update set Solution: Query sys_update_xml to find all related records

Tool: SN-Query-Table
Parameters:
  table_name: sys_update_xml
  query: update_set=<update_set_sys_id>
  fields: type,target_name,name

Common Issue 3: Script Syntax Errors Not Detected

Symptom: Invalid JavaScript passes validation but fails at runtime Cause: Basic syntax check doesn't catch all JavaScript errors Solution: Use ServiceNow's syntax checker or background script test

Tool: SN-Execute-Background-Script
Parameters:
  script: |
    try {
      eval('<script_content>');
      gs.info('Syntax check passed');
    } catch(e) {
      gs.error('Syntax error: ' + e.message);
    }

Common Issue 4: Workflow Validation Times Out

Symptom: Workflow validation takes too long or fails Cause: Complex workflow with many activities and transitions Solution: Break validation into smaller chunks

# Validate activities separately
Tool: SN-Query-Table
Parameters:
  table_name: wf_activity
  query: workflow_version.workflow=<sys_id>
  limit: 50
  offset: 0

# Then transitions
Tool: SN-Query-Table
Parameters:
  table_name: wf_transition
  query: workflow_version.workflow=<sys_id>
  limit: 100

Examples

Example 1: Complete Catalog Item Validation

# Step 1: Get catalog item details
Tool: SN-Query-Table
Parameters:
  table_name: sc_cat_item
  query: sys_id=abc123
  fields: name,short_description,active,category,workflow
  display_value: all

# Result:
name: "New Laptop Request"
active: true
category: "Hardware"
workflow: "Standard Laptop Fulfillment"

# Step 2: Validate variables
Tool: SN-Query-Table
Parameters:
  table_name: item_option_new
  query: cat_item=abc123
  fields: name,question_text,type,mandatory,reference,order

# Result:
- laptop_type (Select Box, mandatory) - OK
- memory_size (Select Box) - OK
- justification (Multi-line, mandatory) - OK
- manager_approval (Reference to sys_user) - OK

# Step 3: Validate variable choices exist
Tool: SN-Query-Table
Parameters:
  table_name: question_choice
  query: question.cat_item=abc123
  fields: question.name,text,value

# Result:
laptop_type choices: Standard, Developer, Executive - OK
memory_size choices: 8GB, 16GB, 32GB - OK

# Step 4: Validate workflow exists and is published
Tool: SN-Query-Table
Parameters:
  table_name: wf_workflow
  query: name=Standard Laptop Fulfillment
  fields: name,published,active

# Result:
published: true
active: true - OK

# Final Status: PASS - All validations passed

Example 2: Business Rule Performance Validation

# Step 1: Get business rule
Tool: SN-Query-Table
Parameters:
  table_name: sys_script
  query: name=Auto Assign Critical Incidents
  fields: name,when,collection,active,script,filter_condition

# Result:
name: "Auto Assign Critical Incidents"
when: "before"
collection: "incident"
filter_condition: "priority=1"
script: (see below)

# Step 2: Analyze script for anti-patterns
Script Content:
```javascript
(function executeRule(current, previous) {
  var gr = new GlideRecord('sys_user_group');
  gr.addQuery('name', 'Critical Incident Team');
  gr.query();
  if (gr.next()) {
    current.assignment_group = gr.sys_id;
  }

  // ISSUE FOUND: GlideRecord query in before rule
  // This runs on EVERY insert of P1 incident
})(current, previous);

Step 3: Generate recommendations

Issues Found:

1. WARNING: GlideRecord query in before rule
   • Impact: Performance degradation on incident creation
   • Recommendation: Cache group sys_id in system property or use gs.getProperty()

Recommended Fix:

(function executeRule(current, previous) {
  // Use cached value instead of query
  var criticalTeamId = gs.getProperty('x_app.critical_team_sys_id');
  if (criticalTeamId) {
    current.assignment_group = criticalTeamId;
  }
})(current, previous);

Final Status: WARNING - Performance issue detected

### Example 3: Workflow Dead-End Detection

Step 1: Get workflow activities

Tool: SN-Query-Table Parameters: table_name: wf_activity query: workflow_version.workflow=wf123 fields: sys_id,name,activity_definition.name

Result:

• act1: Begin
• act2: Create Task
• act3: Approval
• act4: If Approved (Branch)
• act5: Fulfill Request
• act6: End
• act7: Send Rejection Email

Step 2: Get all transitions

Tool: SN-Query-Table Parameters: table_name: wf_transition query: workflow_version.workflow=wf123 fields: from.name,to.name,condition

Result:

• Begin -> Create Task
• Create Task -> Approval
• Approval -> If Approved
• If Approved -> Fulfill Request (condition: approved)
• If Approved -> Send Rejection Email (condition: rejected)
• Fulfill Request -> End

Step 3: Analyze for issues

ISSUE FOUND: Dead-end activity

• "Send Rejection Email" (act7) has no outgoing transition
• This will cause workflow to hang after rejection

Recommendation:

Add transition from "Send Rejection Email" to "End"

Final Status: FAIL - Workflow has dead-end activity

### Example 4: ACL Coverage Validation

Step 1: Get all ACLs for table

Tool: SN-Query-Table Parameters: table_name: sys_security_acl query: name=x_app_custom_table fields: name,operation,type,active,admin_overrides,role.name

Result:

• x_app_custom_table (read) - role: x_app.user - ACTIVE
• x_app_custom_table (write) - role: x_app.admin - ACTIVE
• x_app_custom_table (create) - role: x_app.admin - ACTIVE
• x_app_custom_table (delete) - role: x_app.admin - ACTIVE
• x_app_custom_table.* (read) - role: x_app.user - ACTIVE

Step 2: Analyze coverage

Operations Covered:

• read: YES
• write: YES
• create: YES
• delete: YES

Field-Level ACLs:

• . (all fields): YES

Step 3: Check for gaps

ISSUE FOUND: No row-level restriction

• All users with x_app.user role can read ALL records
• Consider adding condition for record-level security

Recommendation:

If records should be user-specific, add condition: created_by=javascript:gs.getUserID()

Final Status: WARNING - Consider row-level security

## Related Skills

- `admin/schema-discovery` - Understanding table structures for validation
- `admin/update-set-management` - Managing validated configurations
- `admin/batch-operations` - Fixing validation issues in bulk
- `admin/deployment-workflow` - Deploying validated configurations

## References

- [ServiceNow Instance Scan](https://docs.servicenow.com/bundle/utah-application-development/page/build/instance-scan/concept/instance-scan.html)
- [Catalog Item Best Practices](https://docs.servicenow.com/bundle/utah-servicenow-platform/page/product/service-catalog-management/concept/c_ServiceCatalogBestPractices.html)
- [Workflow Best Practices](https://docs.servicenow.com/bundle/utah-servicenow-platform/page/administer/workflow-administration/concept/c_WorkflowBestPractices.html)
- [Business Rule Best Practices](https://docs.servicenow.com/bundle/utah-application-development/page/script/server-scripting/concept/c_BusinessRuleBestPractices.html)
- [ACL Best Practices](https://docs.servicenow.com/bundle/utah-platform-security/page/administer/contextual-security/concept/access-control-best-practices.html)