After the HR Admin [sn_hr_core.admin] role has been removed from the Admin role, how may a user with only the Admin role add members to HR groups?

In ServiceNow HR Service Delivery, HR groups are protected by Access Control Lists (ACLs) that specifically require the snhrcore.admin role. When this role is removed from the Admin role, users with only the Admin role lose the ability to modify HR group memberships. The Admin role alone does not override HR-specific ACLs, which are designed to maintain separation of duties and protect sensitive HR data. This security model ensures that HR administration remains under the control of designated HR personnel.

A. Securityadmin role does not grant HR-specific permissions; it manages platform security settings.

B. HR groups have specialized ACLs that prevent standard group membership processes without HR roles.

D. Impersonation requires the impersonated user's roles; Admin cannot impersonate roles they don't possess.

1. ServiceNow HR Service Delivery Administration Guide

"HR Security Model and Roles" section

pages 45-47

2. ServiceNow Access Control Lists Documentation

"Role-Based Access Control for HR Applications"

Doc ID: KB0745123

3. ServiceNow Platform Security Architecture

"Application-Specific Role Requirements"

Version 2023.2

pages 112-115