Back to projects
ServiceNow PDI · CSA exam prep project

Crestline
Kit Tracker

A loaned equipment tracking app built from scratch on a Personal Developer Instance, deliberately targeting the three areas the CSA exam covers that my day-to-day service desk work doesn't: data modelling, ACL configuration, and CMDB/CSDM ownership.

Data Modelling ACLs Import Sets CMDB / CSDM Security Center
Complete

The five phases

01 Data schema fundamentals

Built a scoped app with two custom tables: u_kit_item (standalone — serial number, status, purchase cost) and u_kit_loan (extends Task — inheriting number, state, and assignment group for free). Added a dictionary override to see field behaviour diverge across the extension hierarchy, then traced both tables in Tables & Columns to compare an extended table against a standalone one.

Table extension Dictionary overrides
Kit Loan table showing 60+ fields inherited from the Task table
Click to expand

u_kit_loan extending Task — number, state, assignment group and every approval field inherited without being built.

02 ACLs

Created two roles — u_kit_manager for table-level access and u_kit_finance for a single sensitive field. Built table-level ACLs (read/create/write/delete) and a separate field-level ACL restricting u_purchase_cost to a different role entirely. Added a script-based ACL on Kit Loan (answer = current.u_requested_for == gs.getUserID();) so a requester can always see their own loan regardless of role.

Table & field ACLs Script-based conditions Impersonation testing
Field-level ACL on Purchase Cost requiring the u_kit_finance role
Click to expand

Field-level ACL scoping Purchase Cost to a separate finance role.

Impersonated test user unable to see the Purchase Cost field
Click to expand

Impersonated as a manager-only user — Purchase Cost isn't offered at all.

03 Import sets & transform maps

Loaded a CSV with deliberately mismatched column headers (AssetSerial, ItemState, Cost) against a Transform Map, then ran the same file three times to see the full lifecycle: a clean first import, a second run creating silent duplicates with no coalesce field set, and a third run — after enabling coalesce on u_serial_number — correctly updating existing records instead of duplicating them.

Field mapping Coalesce behaviour
Duplicate kit item records created by re-importing without coalesce set
Click to expand

Every serial number duplicated after a second import with no coalesce field.

Clean kit item list with no duplicates after enabling coalesce
Click to expand

Same 24 rows, third run — coalesce on serial number updates instead of duplicates.

04 CMDB & CSDM

Browsed the native cmdb_ci class hierarchy (Configuration Item → Hardware → Computer → Server) to see the same extension pattern from Phase 1 applied at platform scale. Created a Business Application CI and a Server CI for Crestline, related them via Runs on::Runs, then linked an Incident to the Server CI to tie CMDB back into the ITSM tables I already work with daily.

CI Class Manager CI relationships Incident linkage
Runs on::Runs relationship between the Crestline Server and Business Application CIs
Click to expand

Crestline Kit Tracker Server related to the Business Application CI via Runs on::Runs.

05 Security Center & Shared Responsibility Model

Reviewed the Shared Responsibility Model conceptually — ServiceNow secures the platform (infrastructure, hosting, patching); the admin secures everything configured on top of it (ACLs, data classification, business logic, instance hardening). Then explored Security Center's live dashboard, which surfaces exactly that admin-owned half: hardening compliance score, threshold alerts, and posture recommendations.

Shared Responsibility Model Instance hardening
Security Center dashboard showing a 90% hardening compliance score
Click to expand

Security Center's posture dashboard — every metric here reflects admin-owned configuration, not platform security.

Supporting documents

View Crestline Brand Guidelines