This is a simulation, not a live instance. Everything below runs as JavaScript in your browser. There is no ServiceNow platform, no database, no session, and no server of any kind behind this page. It reimplements the seven access controls shipped in this application so that the rules can be operated rather than only read about. The authoritative artifact remains the update set XML in the repository.

Access control simulator

Scoped application x_2190973_safety, table x_2190973_safety_safety_issue. Switch the acting role and watch the seven access controls decide what is visible and what is permitted.

This page is a JavaScript simulation and there is no server behind it, so with scripting disabled there is nothing to show. The seven access controls it models are documented in full on the project README, and the authoritative artifact is the update set XML in the repository.

Acting as

List view

Evaluation trace

Operations, record by record

The seven access controls

What this simulation does not model

Role inheritance and role containment. Each persona here holds exactly the role named and nothing else.
Scripted access controls. All seven rules in this application are declarative, so there is no script to evaluate, but ServiceNow supports scripted conditions that this page cannot represent.
Inherited access controls from parent tables, and the wildcard rules that apply platform wide.
Elevated privilege. The security_admin elevation that governs the access control table itself is out of scope.
Everything ServiceNow does around the access control decision: query business rules, client scripts, UI policies, before-query business rules, and record level security plugins.
The sample records. The four rows shown here carry the shape and the assignment split of the packaged records, not their literal field values.

Access control evaluation as modeled here follows two documented behaviors: multiple rules matching the same object at the same level are combined with OR, so passing any one of them grants the operation; and field access requires the table-level rule to grant first, which is why the field rule on manager_notes is only ever reached by a role that already has table-level read.