Module A — Scoped Applications

Application Scope Types

📦
Scoped Application
Encapsulates a set of components — tables, business rules, scripts, forms — behind a private namespace. Enhances security for both the app and the global scope. The global scope cannot access scoped-app resources unless access is explicitly granted, and the scoped app has limited access to other scopes unless configured to share.
Recommended For →
New custom applications Store / repository publishing Strong security boundary
🌍
Global Scope
The traditional, unrestricted namespace. Components are broadly accessible across the instance. Offers flexibility but weaker isolation, higher risk of naming collisions, and cannot be published to the ServiceNow Store.
Recommended For →
Platform-wide configuration Legacy customisations
🧭 CTA Responsibility: As Certified Technical Architect, you help customers translate business requirements into application design and development decisions — starting with the correct scope choice, since it determines which resources are available to the rest of the platform.

Application Creation Lifecycle

1
Understand business requirements — capture the specific needs of the application and its users
2
Develop the application — record and scope, UI, business logic, automation, and security
3
Test the application — validate functionality, data handling, and cross-scope behaviour
4
Deploy the application — publish via the appropriate sharing method to target instances

Required Development Actions

🗂️
App Record & Scope
  • Define scope, roles, and basic data model correctly from the start
  • ServiceNow Studio opens/edits app files across any scope
  • Tabs are color-coded and grouped by scope
  • Scope and update set visible at bottom of screen
🖥️
Design the UI
  • Identify target personas and their needs
  • Optionally use UI Builder for workspace/portal experiences
  • Prioritise accessibility
  • Follow ServiceNow leading practices for consistency
⚡
Business Logic & Automation
  • Determine logic based on gathered requirements
  • Develop workflows and scripts to automate processes
  • Meet business needs efficiently
🔐
Application Security
  • Implement role-based access control
  • Set appropriate limits per user persona
  • Enforce least-privilege access to privileges/permissions

Sharing Method → Availability → Use Case

A
Application repository → all instances of the same company → transfer an app to a test or production environment
B
ServiceNow Store → all ServiceNow customers → share or sell applications to other companies
C
Update set → any instance with access to the update set file → save a version for compliance or backup
D
Source control (Git) → any instance with access to the Git repository → large teams, multiple dev environments, same app in parallel
E
Team development push → other instances in the team dev environment → push developer changes to the parent dev instance

Studio Repositories

ServiceNow Store
Requires a private scope, Technology Partner Program (TPP) membership, and application certification. Global apps cannot be published here. Only instances sharing the vendor prefix can publish new versions.
Reach entire ecosystem TPP membership required Not for standard dev
Most Common
Application Repository
Makes the app available to all instances of the same company. Built-in versioning — development notes are critical. Restricted to instances of that company only.
No update set management Safe upper-instance installs Version downgrade option
Source Control Repository
Industry-standard Git — cloud-hosted (GitHub, GitLab, Bitbucket) or self-hosted. Confirm company policy on public vs self-hosted repos before configuring.
Large team support Branch merging Requires Git governance
⚠️
Update Sets Caveat: A viable deployment option, but updates must be in the correct scope before completing the set. Managing multiple scopes is challenging — batching update sets is recommended.

How sys_scope_privilege Works

🛠️ Design-Time Tracking
While building the app, the system automatically records how it uses resources outside its scope. Records are only created when cross-scope functionality is actually executed during development — untested code paths generate no record.
🚦 Run-Time Enforcement
Once installed on a customer instance, the system switches from tracking to enforcing. Any access without a matching sys_scope_privilege record is blocked, and the user sees a warning message.

Cross-Scope Boundary Types

📋 CRUD operations on a table in a different scope — each operation tracked separately
📜 Executing a script in another scope — e.g. global.someThing(), sn_app.someThing()
⚙️ Platform APIs exposed to script — GlideRecord, RESTAPIRequest, the gs object

Cross-Scope FAQ

Q
Can I manually create a privilege record to unlock a restricted resource? No — table/script-include settings override any manually created record.
Q
Does disabling Runtime Access Tracking grant unrestricted access? No — protected resources (e.g. HR salary data, GlideEncrypter) remain blocked regardless.
Q
Should I turn tracking off if testers hit errors? No — it means code paths weren't exercised during design time; fix the coverage instead.
🔒 Restricting access to only what's needed is a better security posture — and helps customers make informed regulatory and policy decisions about the app.

Scoped Application Leading Practices

👥
Personas & Usability
  • Identify all user personas early
  • Tailor interfaces to how each persona interacts
🔗
Integration & Data Handling
  • Identify integration points early (REST, SOAP, MID server)
  • Validate and cleanse data on import
🏗️
Architecture & Data Design
  • Establish a solid data model early — costly to change later
  • Use join tables for many-to-many relationships
  • Use extensions only when truly beneficial
📚
Support & Documentation
  • Keep architecture, logic, and user docs current
  • Define post-deployment support ownership
♻️
Reusability
  • Build reusable Script Includes and Flow Actions
  • Prioritise low-code/no-code with Flow Designer
Module B — RAD & CI/CD

Five RAD Phases

💬
1. Business Modeling
High-level requirements with stakeholders; information flow between business functions identified. No exhaustive upfront spec required.
Flexible & Adaptive
🗄️
2. Data Modeling
Collected information is analysed and divided into specific data groups; relationships between groups defined.
Group & Relate
🔄
3. Process Modeling
Data objects are converted for use in development, allowing changes and optimisations to be made.
Convert & Optimise
🚧
4. Application Development
Teams build functional prototypes fast, gather feedback, then transform validated prototypes into the full application.
Prototype & Refine
✅
5. Testing & Turnover
Each model tested individually; final product released after thorough testing, with post-deployment monitoring.
Validate & Release
🔁 Continuous feedback is the engine of RAD — empowering enterprises to deliver solutions that meet evolving business needs. RAD is about how you build fast; CI/CD (next) is about how you deploy with confidence.

Foundational CI/CD Terms

📚 Source Control
Tracks and manages code changes — collaboration, versioning, rollback.
🛤️ Pipeline
Automated sequence taking code from development through testing into deployment.
🗃️ Repository
Storage location for code enabling version control and change tracking.

Source Control Integration Steps

🔌
Connect to Git
  • Obtain repo credentials and permissions
  • Supports cloud or on-prem Git
  • Configure URL, branch, and auth
📥
Import Applications
  • Enter repo URL, branch, credentials
  • System retrieves code for deployment/dev
  • Enable auto-upgrade for version alignment
🔃
Apply Remote Changes
  • Sync to latest commits by branch/scope
  • Keeps instance aligned with source control
  • Reduces drift, supports continuous delivery
✔️
Best Practices
  • Clear branch naming; no direct prod-branch edits
  • Sync regularly, resolve conflicts fast
  • Secure access controls and credentials

CI/CD Pipeline Flow

1
Plan & Commit — developer changes made in App Engine Studio or custom code; stored in source control (GitHub, GitLab, Azure DevOps)
2
Continuous Integration — pipeline triggers on commit; automated build packages the update; unit/regression tests run via ATF; static code analysis checks quality, security, upgrade safety
3
Quality Gates & Approvals — governance rules enforced: peer reviews, policy checks (change management integration); only compliant builds advance
4
Continuous Delivery — approved changes auto-promoted to staging/test; further tests executed; on sign-off, deployed to production via controlled promotion
5
Monitor & Improve — deployment status, performance, and error logs monitored; feedback and monitoring data loop back into the next iteration
⏱️ Time-to-Value Impact: Governance gates replace slow manual approvals, continuous delivery keeps apps releasable, pipelines ensure consistent promotion, and automated builds/tests remove manual bottlenecks — catching issues earlier via quick-feedback stages.

Three Types of Sprawl

🧩
Application Sprawl
Too many overlapping or redundant apps across departments — often from decentralised purchasing or unchecked tool adoption. Drives inefficiency, cost, and security/update headaches.
🗃️
Data Sprawl
Uncontrolled distribution of data across databases, platforms, and clouds — caused by siloed systems and duplicate storage. Undermines accuracy, consistency, and compliance.
☁️
Cloud Sprawl
Multiple cloud services from various providers without centralised governance — often business units solving immediate needs independently. Creates security gaps and cost sprawl.

Impacts of Unchecked Sprawl

📈 Increased operational costs from redundant systems and maintenance
📉 Reduced data quality and accuracy from duplicated/outdated sources
🔓 Greater security vulnerabilities across fragmented environments
⏳ Delays in decision-making from inconsistent or inaccessible information
📏 Difficulty scaling operations and supporting future growth

Strategies to Minimise Sprawl

🎯
Single Source of Truth
  • Consolidate data/workflows onto one platform
  • Reduces risk of data sprawl
🏛️
Low-Code Governance
  • Business builds fast; IT keeps oversight
  • Pipelines enforce approvals & security scans
  • Stops shadow IT reaching production
🔗
Integration & Automation
  • Connects disparate systems
  • Controls both data and cloud sprawl
👁️
Visibility & Control
  • Comprehensive view of apps, data, integrations
  • Monitor and approve development activity
🔁
Iterate, Don't Duplicate
  • CI/CD makes iterating existing apps easier
  • Evolve core apps instead of overlapping builds
🧱
Standardised Pipelines
  • Consistent governance and quality checks
  • Predictable delivery instead of ad-hoc chaos

Consolidation Toolset

🔌 Integration Hub
Pre-built connectors and automation activities to unify data across the enterprise.
🧵 Workflow Data Fabric
Centralised, unified data management layer — avoids siloed repositories.
🎛️ Automation Center
Centralised workspace for governing automation and cross-enterprise orchestration.
🌐 API Strategies
Secure, scalable integration with third-party apps; enforces data governance.
🧰 OOB Connectors
Pre-built connectors for popular SaaS/enterprise systems, accelerating projects.
🏦 Case in Point — Bank Consolidation: An Asian bank replaced 300+ custom Lotus Notes apps with App Engine, consolidating point technologies onto a single platform. Projected savings: $70–90M over 5 years, plus a planned Citizen Developer program for business-analyst-led prototyping.

App Development Tools

🧱
App Engine Studio
Low-code environment to build from scratch or templates — rapid prototyping for IT and business users.
Low-Code Build
💻
ServiceNow Studio IDE
Web-based IDE with source control, branching, and CI/CD — for professional developers and larger teams.
Pro-Code Build
📊
App Engine Mgmt Center
Centralised governance and oversight for all low-code app development activity across the org.
Governance Hub
📱
Mobile App & UI Builder
Design intuitive, responsive interfaces and native mobile experiences across devices and channels.
Experience Design
🤖 Now Assist for App Engine: Integrates generative AI directly into development — pre-built tools reduce coding effort, adding automation, NLP, and decision-making via natural-language prompts. App Engine Management Center provides in-built governance for apps built with Now Assist.

Governance Challenges in Rapid Development

👤
Shadow IT
  • Apps built outside IT oversight
  • Duplicate effort, security gaps
🕳️
Data Security & Privacy
  • Rapid dev may bypass security protocols
  • Insecure code, config errors, unvetted deps
📋
Regulatory Compliance
  • Decentralised dev complicates tracking
  • Misconfigured permissions risk PII exposure
⚖️
Quality & Consistency
  • Speed can cost quality/standardisation
  • Weak governance breaks alignment

ServiceNow Governance Features

App Engine Mgmt Center
Centralised oversight for all low-code and rapid development — monitor, approve, and manage apps through the pipeline in line with policy.
Approvals & Access Controls
Configurable approval workflows plus granular RBAC ensure only authorised users build, modify, or deploy apps.
Instance Scan & ATF
Instance Scan evaluates config/code for known issues; ATF validates security controls — only compliant, secure code is promoted.

Risk Reduction Strategies

1
Enforce RBAC and least-privilege permissions; separate duties for CI/CD operations
2
Implement automated testing and CI to catch issues early, with continuous vulnerability scanning
3
Monitor app development with real-time analytics for early anomaly detection
4
Maintain comprehensive audit trails — track every change to code, config, and pipeline actions
5
Provide training and support for citizen developers to promote secure, compliant practices
Takeaway 01
Scoped Apps Protect the Platform
Scoped applications isolate resources into a private namespace, managed and distributed without affecting other platform components.
Takeaway 02
Cross-Scope Privileges Are Non-Negotiable
Properly configuring sys_scope_privilege prevents unintended access while enabling necessary interactions between apps and platform features.
Takeaway 03
Leading Practices Ensure Longevity
Clear standards for personas, data design, documentation, and reusability drive consistency, scalability, and maintainability.
Takeaway 04
RAD Accelerates App Development
Low-code tools, rapid prototyping, and continuous user feedback quickly deliver solutions aligned to business needs.
Takeaway 05
CI/CD Accelerates App Release
Automated pipelines, testing, and governance ensure frequent, reliable, and compliant deployments.
Takeaway 06
RAD + CI/CD Curb Sprawl, Speed Innovation
Reuse, iteration, and centralised governance let organisations innovate rapidly while maintaining enterprise-grade security and compliance.