Our resources are protected, but the scripts inside them still run with full system access – which means they can hand back fields the caller was never meant to see. In this video we fix that with a one-line change, swapping GlideRecord for GlideRecordSecure so the table's own access controls are honoured inside the API. *You'll learn:* - Why GlideRecord runs as the system user and ignores access controls entirely - How to create a field-level access control to restrict a sensitive field, such as PIN, to a single role - How GlideRecordSecure enforces those access controls from inside your resource scripts *Chapters:* - 0:00 Introduction - 0:19 Concept - 2:05 Demo GlideRecord - 2:35 Testing GlideRecord - 2:59 Demo GlideRecordSecure - 3:15 Testing GlideRecordSecure - 3:50 Outro *GitHub:* https://github.com/jnichols-servicenow/SN2026-Vehicles-API *Links:* - ServiceNow docs – GlideRecord – https://www.servicenow.com/docs/r/api-reference/server-api-reference/c\_GlideRecordAPI.html - ServiceNow docs – GlideServer APIs – https://www.servicenow.com/docs/r/api-reference/scripts/p\_GlideServerAPIs.html?section=p\_GlideServerAPIs - ServiceNow docs – Access Controls – https://www.servicenow.com/docs/r/platform-security/access-control/access-control-rules.html - Postman – https://www.postman.com/ *Series navigation:* - Previous: 14 – Machine Identity Access - Next: 16 – OAuth 2.0 - Full playlist: https://www.youtube.com/playlist?list=PLrhqGp3sUzhvp1sfgP8OZjXRxKOP\_cyBU