# Access Forge

> Audit ServiceNow security configuration including ACLs, roles, Business Rules, and data policies for over-permissioning, missing restrictions, and compliance gaps. Severity-rated findings.

- Skill: `jxrlabs/access-forge` (Agent Skill)
- Install (CLI): `npx skillmds@latest add jxrlabs/access-forge`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jxrlabs/access-forge/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: JXRLABS (https://skillmd.com/u/jxrlabs)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/jxrlabs/access-forge

---


# Access Forge

## Purpose

Audit ServiceNow security configuration — ACLs, roles, Business Rules, and data policies — for over-permissioning, missing restrictions, and compliance gaps.

## When to Use

- Before a security audit or compliance review (SOX, HIPAA, etc.)
- When onboarding a new team and reviewing instance security posture
- After a major upgrade or migration that might have changed security behavior
- When investigating "how did this user see that record?" incidents
- As part of regular instance health checks
- When reviewing ACLs exported from the `sys_security_acl` table

## Analysis Framework

### 1. ACL Coverage Audit
- Are there tables with no ACLs at all? (ServiceNow defaults to wide open)
- Are there tables with only admin-level ACLs, missing itil/end-user read access?
- Are field-level ACLs present where sensitive data exists (SSN, salary, health info)?
- Do write ACLs have matching read ACLs on the same table/field?
- Are there redundant or conflicting ACLs (e.g., one allows, another denies)?

### 2. Role Analysis
- Are custom roles granted `admin` indirectly via role inheritance?
- Do non-admin roles have access to `sys_security_acl` or `sys_script` tables?
- Are there stale roles with no active users that still grant permissions?
- Is the `snc_internal` role used appropriately (system operations only)?
- Are role names descriptive and follow a naming convention?

### 3. Business Rule Security
- Do before-Business Rules enforce data integrity that ACLs don't catch?
- Are there Business Rules that bypass ACL logic (e.g., `setWorkflow(false)` + `current.update()`)?
- Do async Business Rules run with elevated privileges unexpectedly?

### 4. Data Policy & Encryption
- Are Data Policies used for fields that should never be empty or should always match a pattern?
- Is field-level encryption configured for PCI/PHI data?
- Are there fields marked as "personal data" for GDPR/privacy compliance?

### 5. Common Misconfigurations
- `*` (wildcard) ACLs granting broad access without justification
- ACL scripts that always return `true` (effectively disabling security)
- ACL conditions that reference hardcoded sys_ids or usernames
- Missing `answer = false` default in custom ACL scripts
- Overly broad `write` ACLs on reference fields that allow data pollution

## Output Format

```
## Security Posture: [Strong / Moderate Risk / High Risk / Critical]

## Critical Findings (Immediate Action Required)
| Finding | Location | Risk | Remediation |
|---------|----------|------|-------------|
| [Description] | [Table/ACL/Role] | [Data exposure/breach risk] | [Specific steps] |

## Warnings (Address Before Next Review)
| Finding | Location | Risk | Remediation |
|---------|----------|------|-------------|
| [Description] | [Table/ACL/Role] | [Compliance/operational risk] | [Specific steps] |

## Observations (Document & Monitor)
| Finding | Location | Note |
|---------|----------|------|
| [Description] | [Table/ACL/Role] | [Why this matters] |

## Compliance Mapping
| Control | Status | Evidence |
|---------|--------|----------|
| [e.g., Least Privilege] | [Pass/Fail/Partial] | [Which ACLs/roles support this] |

## Recommended Priority Order
1. [First fix - highest impact]
2. [Second fix]
3. [Third fix]
```

## Severity Definitions
- **Critical**: Active data exposure, privilege escalation, or compliance violation
- **Warning**: Configuration that will likely become critical under specific conditions
- **Observation**: Unusual but not necessarily wrong; document and monitor

## Input Format
Accept any of these:
- Pasted ACL records (table name, operation, role, condition script)
- Exported role lists with inherited roles
- Screenshots of security configuration (describe what you see)
- Specific user complaints about access issues

## Tone
Be thorough but not alarmist. Every ServiceNow instance has some security debt. The goal is to find the issues that matter, rank them honestly, and give actionable fixes — not to generate a 50-page report no one will read.