{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40352,"path":"platform-security/access-control/view-permissions-for-a-user.md","title":"View permissions for a user","bundle":null,"doc_type":null,"release":"australia","body":"\n# View permissions for a user\n\nUse Access Analyzer to view permissions for a selected user.\n\n## Before you begin\n\nRole required: access\\_analyzer\\_admin\n\nThis procedure explains how to view the permissions for a specific user \\(such as **ITIL User**\\) on the **Incident** table by using the Evaluate Access feature in Access Analyzer.\n\n**Note:** Access Analyzer is a ServiceNow AI Platform Store product.\n\n## Procedure\n\n1. Navigate to **All** > **Access Analyzer** > **Analyze Permissions**.\n\n The Analyze access and permissions homepage is displayed.\n\n2. Select your criteria as follows:\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nAnalyze by \\*\n\n\n\nSelect **User**.\n\n
\n\nSelect user \\*\n\n\n\nSpecify a user name to select from the list. In this example, **ITIL User**.\n\n
\n\nRule type \\*\n\n\n\nAnalyze access for the following:- Table\n- UI page\n- REST Endpoint\n- Client callable script include\n- AI Agent\n- Agentic workflow.\nIn the example, `Table`\n\n.\n\n
\n\nSelect table \\*\n\n\n\nSpecify a table name to select from the list. In this example, **Incident**.\n\n
\n\nSelect record\n\n\n\nSpecify a record name to select from the list. In this example, **INC0000001**.\n\n
\n\nSelect field\n\n\n\nSpecify a field name to select from the list. This field can be used to analyze permissions even at the field level. For example, Active, Created By, and so on.\n\n
3. Specify the description in the **Description** field.\n\n4. Click **Analyze permissions**.\n\n \\[Omitted image \"view-permissions-for-a-user.png\"\\] Alt text: Permission evaluation of Abel Tuter\n\n The system displays **Access results** for the **ITIL User**.\n\n \\[Omitted image \"permissions-for-a-user.png\"\\] Alt text: Permission results\n\n The results can be read by referring to the Legends, access control list \\(ACL\\), IAccesshandler, and Data filters.\n\n Let's take the example of **read** operation. For the **ITIL User** overall access is Passed, which means the user is able to read the record with the correct permissions \\(ACL\\).\n\n Similarly for **create** operation, the overall access is passed with an alert icon, which means that there could be a presence of script for the ACL evaluation.\n\n **Note:** In the example, **write** and **delete** operations are blocked for the selected user and the user can’t edit or delete the selected record \\(INC0000001\\).\n\n5. Select read operation to know more about the Debug logs.\n\n \\[Omitted image \"acl-details-for-user.png\"\\] Alt text: ACL Details\n\n The Debug logs page displayed the business rule and associated ACLs that are required to perform the **read** operation for the record.\n\n The Debug logs shows that there’s a business rule and four ACLs associated for the read operation.\n\n There’s a status **Passed** for one of the ACL, which means to read the selected record, the user has the required ACL and can read the record. Since one of the ACL is **Passed**, the other ACL evaluations are **Skipped**.\n\n6. Select the Access Control that is Passed to see the details of the ACL.\n\n \\[Omitted image \"view-details-for-a-user.png\"\\] Alt text: Details of the Access Control for the selected ACL\n\n The system displays the Access Control details for the selected ACL.\n\n If a selected operation that has `Passed` contains a script, the Access Control page displays the associated script for the record.\n\n \\[Omitted image \"script-for-a-user.png\"\\] Alt text: Script Condition in Access Control\n\n\n"}}