Demos / Security and compliance
Demo · 0:56
One script and nothing else
A role that lets the ServiceNow integration run one script and no other. The allowed script succeeds from a ServiceNow background script, a password reset is refused, and the audit trail shows both.
Recorded on the real product against our demo company, Lakefront Works. The people and data are fictional.
Transcript
When ServiceNow starts a script, it signs in to PowerScripts as its own user. That user is a Script Operator, and that level alone runs nothing. It needs a role. Alan creates a role for it. He names it, ticks the one script ServiceNow should run, and adds the ServiceNow user. Members can run what the role holds and nothing else. Now ServiceNow calls PowerScripts, the same way a request would. First it asks for that script, and then for a password reset it was never given. The first run starts. The second is refused: you are unauthorized to run this script. Both are in the audit under the ServiceNow user. The refused one says what was tried, who tried it and why it was denied.