Governance policy: deny-by-default instead of allowlist - #1
Open
mitchellOpZero wants to merge 2 commits into
Open
Governance policy: deny-by-default instead of allowlist#1mitchellOpZero wants to merge 2 commits into
mitchellOpZero wants to merge 2 commits into
Conversation
Writes are now allowed on any table except the security boundary: identity, roles/privilege escalation, ACLs, auth/credentials, system properties, and fix scripts. Security namespaces (sys_security*, oauth_*, sys_auth_*) fail closed by prefix so unlisted sensitive tables are still blocked. The allowlist blocked most legitimate dev work (portal widgets, knowledge, ITSM tables) while allowing arbitrary-code tables like sys_script, so it added friction without adding a coherent boundary. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ny-list default Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
servicenow/01-…Governance_API.js: removed the 16-table write allowlist. Writes are now allowed on any table except the security deny list, which grew from 11 to 15 tables (addedsys_user_role,sys_user_grmember,sys_security_acl_role,oauth_credential) plus fail-closed prefix guards forsys_security*,oauth_*,sys_auth_*.Why
The allowlist blocked most legitimate dev work — Service Portal widgets, knowledge articles, ITSM tables were all denied — while simultaneously allowing arbitrary-server-code tables like
sys_scriptandsys_script_include. That's friction without a coherent security boundary, and friction is how teams end up bypassing the governed path entirely.The deny list now covers the actual boundary — writes that change who can do what (identity, roles, group membership, ACLs, auth, credentials, system properties, fix scripts) — and everything else flows through the existing check → approve → verify controls (human-approved one-use tokens, prod read-only, credential-field blocking, script pattern checks).
Verified on a live PDI
Deployed to dev353573 and exercised through the governed endpoint:
sp_widget/kb_knowledgewrites → approved (previously blocked)sys_user_grmemberinsert → blocked (previously would have passed — group membership is privilege escalation)sys_security_something_new→ blocked by prefix guard (fails closed)🤖 Generated with Claude Code