A little while ago I needed to set up a new user criteria to restrict access to a catalog item.
As is my usual pattern, once I had set up what I thought was a valid user criteria, I tested my work by impersonating a user who shouldn’t have access to the catalog item and then attempting to access the catalog item.
Much to my surprise, the impersonated user was able to access the catalog item. I went back and checked my script on the user criteria and realized that I had a typo there which was causing it to authorize everyone.
I fixed the script, saved the user criteria, and then impersonated the user again so that I could confirm that they no longer had access to the catalog item.
Contrary to what I was expecting, they were still able to access the catalog item. After several iterations of making changes to the script and then checking the user’s access, I realized that the script had been working correctly from version 2 onwards.
The issue wasn’t with the script, but rather with the fact that ServiceNow caches the access somewhere. As nearly as I can tell, it checked the user criteria the first time that my impersonated user tried to access the catalog item, and then after that it just checked whatever flag it had saved off that indicated that the user had access to that catalog item.
When I pulled up another user–with identical flags to the first user, they were correctly barred from accessing the catalog item.
The next day, my first user was no longer able to access the catalog item, so it appears that some kind of scheduled job either clears out the caching or updates the caching to the latest user criteria on some kind of regular (probably nightly) basis.