{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":680,"path":"api-reference/scripts/script-sandbox-environment.md","title":null,"bundle":null,"doc_type":null,"release":null,"body":"---\ntitle: Script sandbox environment\ndescription: The script sandbox environment is a restricted execution context in which untrusted, client-generated scripts run on the server using one of two evaluators: the guarded script evaluator or the script sandbox evaluator.\nlocale: en-US\ncanonical_url: https://www.servicenow.com/docs/r/australia/api-reference/scripts/script-sandbox-environment.html\nrelease: australia\nproduct: Scripts\nclassification: scripts\ntopic_type: concept\nlast_updated: \"2026-05-05\"\nreading_time_minutes: 3\nbreadcrumb: [Server-side scripting, Scripting, API implementation, API implementation and reference]\n---\n\n# Script sandbox environment\n\nThe script sandbox environment is a restricted execution context in which untrusted, client-generated scripts run on the server using one of two evaluators: the guarded script evaluator or the script sandbox evaluator.\n\n## Script sandbox environment overview\n\nWhen a script is sent to the server, a server-side script evaluator determines whether the script is trusted. Trusted scripts run in the JavaScript engine. Untrusted scripts run in the restricted sandbox environment instead.\n\n**Note:** The sandbox does not apply to script includes, which run in the application scope outside of the sandbox, or to client-side scripts.\n\nUntrusted scripts are client-generated and sent to the server for evaluation in the following ways:\n\n-   Filter or query parameters: Filter and query parameters in URLs can send scripts to the server with HTTP requests, such as when a logged-out user follows a link containing a `javascript:` filter parameter.\n-   System APIs: The AJAXEvaluate API call allows the client to run arbitrary scripts on the server and receive a response.\n\nWithin the sandbox, the following restrictions apply to scripts:\n\n-   Only business rules marked **Client callable** can be called.\n-   Only script includes marked **Sandbox enabled** can be called.\n-   Certain API calls, mostly limited to ones dealing with direct database access, aren’t allowed.\n-   Data can’t be inserted, updated, or deleted from within the sandbox. For example, any calls to current.update\\(\\) are ignored.\n\n**Note:** Beginning with the Xanadu release, script includes marked as **Glide AJAX enabled** \\(previously named **Client callable**\\) aren’t accessible within the sandbox. Only those marked **Sandbox enabled** are available within the sandbox. When upgrading to the Australia release from the Washington DC release or earlier, any script includes marked as **Client callable** are also marked as **Sandbox enabled**.\n\n## Script sandbox evaluators\n\nBeginning with the Australia Patch 2 release, the sandbox uses two evaluators to enforce different levels of restrictions:\n\n-   Guarded script evaluator: Enhances instance security by supporting only a restricted scripting language and rejecting untrusted scripts that are incompatible. Guest transactions are fully enforced immediately. Scripts sent by authenticated users are evaluated differently depending on the instance type.\n-   Script sandbox evaluator: Helps prevent executing untrusted scripts on an instance by limiting the APIs available to scripts.\n\n<table id=\"table_evaluator_comparison\"><thead><tr><th>\n\nCharacteristic\n\n</th><th>\n\nGuarded script evaluator\n\n</th><th>\n\nScript sandbox evaluator\n\n</th></tr></thead><tbody><tr><td>\n\nPurpose\n\n</td><td>\n\nProvides enhanced security for scripts that run in the sandbox. Uses a domain-specific language \\(DSL\\) that permits only a small set of JavaScript features.\n\n</td><td>\n\nSupports additional JavaScript but restricts certain APIs for scripts.\n\n</td></tr><tr><td>\n\nJavaScript support\n\n</td><td>\n\nOnly a single simple expression or function call and only certain APIs.\n\n</td><td>\n\nFeatures supported by the JavaScript engine except for certain API and method restrictions.\n\n</td></tr><tr><td>\n\nWhen it runs\n\n</td><td>\n\nEvaluates untrusted scripts that haven't been granted a guarded-script exemption.\n\n</td><td>\n\nEvaluates untrusted scripts under the following conditions:-   A script has been granted a guarded-script exemption \\(manually or automatically\\).\n-   When guarded script is in Phase 1: Detection, and a script is sent to the server by an authenticated user.\n\n</td></tr><tr><td>\n\nScript includes\n\n</td><td>\n\nNot applicable: script includes run outside the sandbox in the application scope\n\n</td><td>\n\nNot applicable: script includes run outside the sandbox in the application scope\n\n</td></tr></tbody>\n</table>For details about each evaluator, including JavaScript restrictions, see the following topics and the [Server-Side Sandbox Runtime Replacement \\[KB2944435\\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2944435) article on the Now Support Knowledge Base.\n\n-   **[Guarded script evaluator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/scripts/guarded-script.md)**  \nThe guarded script evaluator enhances instance security by supporting only a restricted scripting language and detecting or rejecting untrusted scripts that use unsupported JavaScript features.\n-   **[Script sandbox evaluator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/scripts/script-sandbox.md)**  \nThe script sandbox evaluator helps prevent executing untrusted scripts on an instance by limiting the APIs available to scripts.\n\n**Parent Topic:**[Server-side scripting](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/scripts/c_ServerScripting.md)\n\n"}}