In the previous chapter, we briefly touched on ACLs (otherwise known as security rules or Access Control Lists) and how they can be used to control whether or not a field is visible or read-only on the form. However, ACLs also have a server-side component, not entirely unlike a cross between UI policies and data policies, except that you're able to script conditions for ACLs. You can access the security rules in ServiceNow by navigating to System Security | Access Control (ACL) in the application navigator. This will take you to the Access Control [sys_security_acl] table list.
Note
Since we're going to be working with security rules, let's start by checking if we need to elevate our permissions. Click on the profile button at the top-right of the ServiceNow interface in the banner frame, and see if Elevate Roles is an option. If it is, click it, and make sure that the security_admin tick-box is selected, then click OK. More on High Security settings and permissions elevation...