Having one role for the entire API isn't enough. Reading a vehicle record and deleting one shouldn't require the same permissions. In this video we give each resource its own access control, splitting read and update from create and delete – and we create a v2 of the API to hold the change. *You'll learn:* - How resource-level access controls are evaluated before the resource script runs - How to map read and update to the integration role, and create and delete to a higher-privilege integration_admin role - Why a significant change in API behaviour justifies a new version, and how to copy resources into it *Chapters:* - 0:00 Introduction - 0:25 Concept - 1:55 Versioning - 2:32 Demo - 3:55 Testing - 4:47 Outro *GitHub:* https://github.com/jnichols-servicenow/SN2026-Vehicles-API *Links:* - ServiceNow docs – Custom web services (resource security) – https://www.servicenow.com/docs/r/api-reference/rest-api-explorer/c\_CustomWebServices.html - ServiceNow docs – Access control rules – https://www.servicenow.com/docs/r/platform-security/access-control/access-control-rules.html - Postman – https://www.postman.com/ *Series navigation:* - Previous: 13 – Access controls II – restricting what an integration user can reach - Next: 15 – GlideRecordSecure() - Full playlist: https://www.youtube.com/playlist?list=PLrhqGp3sUzhvp1sfgP8OZjXRxKOP\_cyBU