What Query Business Rule in Servicenow

The Complete Guide to Query Business Rules in ServiceNow: Boosting Security and Performance

Ever opened a list in ServiceNow and realized you can’t see all the records you expected, even though you know they’re in the system? You’re not alone. There’s some real magic happening behind the scenes that shapes how much data each user can actually view — and the hero here is the Query Business Rule.

In this guide, I’ll break down what query business rules are, how they fit into the bigger picture, and why every developer and admin should understand their power. You’ll see practical examples, learn best practices, and find out how these rules help keep data secure, fast, and tidy.

[embed]

Understanding Business Rules in ServiceNow

In ServiceNow, business rules are server-side scripts that run whenever a record is accessed or changed. That’s a broad job description, so here’s a simple breakdown:

• When do business rules trigger?
• When you query, display, insert, update, or delete a record.

These rules shape almost every part of ServiceNow’s data life cycle. In the platform, you’ll see different rule types under the “When to run” tab:

Rule Type Timing Typical Purpose Before Before the data saves Validate or change data just before saving After After data saves Kick off additional tasks (like notifications) Async Background Run non-urgent tasks quietly in the background Display Before form displays Prep data before loading the interface Query Before fetch Limit/shape which records get sent back

Query business rules are unique. They act as a filter before the system even touches the database, quietly shaping the data users can see before anything else happens.

What Makes Query Business Rules Special?

Imagine you’re lining up at a club, and the security guard checks IDs before letting people in. Query business rules work in the same way, making sure only certain records get past the gate, based on set conditions.

Here’s how the data flow looks, step by step:

1. A user or a system asks for records (like opening an incident list).
2. Query business rules activate first.
3. These rules rewrite or add conditions to the database request.
4. Only approved records move forward for further actions, like display or editing.

Unlike other rule types, query business rules don’t change the data itself. Instead, they control which records become visible, adding a protective layer that’s all about access, security, and clarity.

Example: Restricting Incident Visibility by Group

Let’s step into a real-world example. Say your team wants each user to only see incident tickets assigned to their group. This keeps sensitive info safe and prevents confusion.

I’d create a query business rule on the Incident table. Here’s how that looks:

1. Name the rule clearly — something like “Restrict Incidents to User’s Group.”
2. Point the rule at the Incident table.
3. Check the advanced option to use a script for more control.

Within the script:

• Get the current user and their groups.
• Filter incident records so the user sees only incidents in their groups.

Here’s how the process unfolds:

• When Beth Anglin, a member of specific groups, logs in and views open incidents, she only sees tickets linked to her groups.
• If the rule is inactive, Beth sees all 152 records.
• Turn on the rule, refresh, and she’ll only see the relevant records she’s allowed to interact with.

This process all happens before the list ever finishes loading — the system only sends records she’s supposed to see.

Key Benefits of Query Business Rules

Query business rules in ServiceNow play a quietly powerful role. Here’s what they do best:

• Protect privacy & boost security: Only authorized people see sensitive records, preventing accidental leaks.
• Enforce organizational data rules: Company policies can restrict what data is visible to which teams or roles.
• Improve performance: By trimming out irrelevant records before they fetch, lists load faster and use less bandwidth.
• Promote consistency: No one relies on remembering to add filters. The system enforces the rules, every time.

Paired with ServiceNow’s access control lists (ACLs), you get sharp, reliable control over who sees what and when — both at the row and field level.

Setting Up Query Business Rules: Step-by-Step

Here’s how I go about adding a query business rule, with an eye on future maintenance:

1. Clear naming: I use names that make the rule’s purpose obvious, like “Restrict Incidents to Group Membership.”
2. Target table: Make sure to set the rule to the correct table (like Incident) to avoid trouble later.
3. Advanced scripting: With the advanced box checked, I add logic that checks the user’s group memberships.
4. Add conditions carefully: On current.addQuery, I make sure only records matching the user’s groups come through.
5. Test in a developer instance: I always use a free ServiceNow developer instance to check my rule first. I try it as different users and groups to be sure the rule behaves correctly.

Here’s a summary of common steps:

Task Description Name the rule ‘What does this restrict?’ Target table e.g., Incident, Change Request Check Advanced Allows for scripting complex logic Write script Add user-group logic for filtering Test as users Validate with impersonation or test accounts

Best Practices for Using Query Business Rules

It’s tempting to make rules as tight as possible, but good rules are:

• Efficient: Keep queries simple so they don’t drag down system performance.
• Well-documented: Write clear inline comments and keep track of why rules exist.
• Role-tested: Log in as various user roles to make sure the rules have the intended effect.
• Not a replacement for ACLs: I always use query rules together with access control lists for layered security. Don’t put everything in one rule.

Avoid these pitfalls:

• Overly restrictive rules that hide too much data
• Complex conditions that slow down the database
• Forgetting to test under different user situations

Check out detailed advice in this user groups best practices playlist, which can help you keep your setup clean and future-proof.

Recap: Why Query Business Rules Matter

To sum up, query business rules shape and protect your ServiceNow data:

• They act as a gatekeeper, deciding what data users see before anything else happens.
• They secure privacy, keep records consistent, and speed up performance.
• They work best when paired with other security features like ACLs.

With just a few lines of script, you can tighten access and improve user experience — without touching the user interface.

For a deeper look into business rules’ full life cycle (before, after, display, async), watch the complete ServiceNow business rules lesson where I walk through examples and provide more details for every rule type.

Final Thoughts

Query business rules in ServiceNow let me give users the right view of data, keep sensitive records private, and make sure everything runs smoother and safer. When used with discipline and good documentation, they take the heavy lifting off users and let the system handle security and filtering in the background.

If this was helpful, subscribe to TechTalk with Bill for more ServiceNow tutorials.

Let me know your favorite query business rule use case in the comments below.