---
title: Application Runtime Policy modes
description: When enabled, Application Runtime Policy operates in two possible modes: Tracking and Enforcing. Tracking mode automatically allows out-of-scope access attempts, while Enforcing mode automatically blocks out-of-scope access attempts until you review them.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/application-development/arp-modes.html
release: australia
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 2
keywords: [Application Runtime Policy modes, Tracking mode, Enforcing mode, ARP]
breadcrumb: [Configure, Application Runtime Policy \(ARP\), Developing your application, Classic app development, Building applications]
---

# Application Runtime Policy modes

When enabled, Application Runtime Policy operates in two possible modes: Tracking and Enforcing. Tracking mode automatically allows out-of-scope access attempts, while Enforcing mode automatically blocks out-of-scope access attempts until you review them.

## Tracking mode

When Application Runtime Policy \(ARP\) is set to tracking mode for an application you're developing, network and cross-scope policy records are generated during development and set to the **Allowed**. No access is blocked, and you don't have to manually approve out-of-scope access attempts. If anything in the policy records does require modification, you can make manual changes as needed.

When a violation occurs in tracking mode, an informational message appears on the application page the violation originated from, indicating that the application attempted out-of-scope access. The access is allowed and any features that rely on out-of-scope access function as programmed.

**Note:** If you use Tracking mode while developing an application, you must change the mode to Enforcing before the application can be published to the ServiceNow Store or the Application Repository.

## Enforcing mode

When an application is set to enforcing mode during development, ARP automatically creates network and cross-scope policy records but sets the state to **Requested** by default. Until the application author approves a policy, the corresponding access attempt is blocked.

When a violation occurs in enforcing mode, an error message appears on the application page indicating that the access attempt was blocked. Features that rely on the out-of-scope access might not be loaded, or might not function properly. You must navigate to the applicable policy table, find the policy record, and set its status to **Allowed** to enable access.

When an application with ARP in Enforcing mode is installed in another instance, either from the Application Repository or the ServiceNow Store, ARP functions in the following ways:

-   ARP does not automatically create policy records in a requested state, even with the mode set to Enforcing.
-   ARP blocks access to out-of-scope resources like tables, scriptables, script includes, and network APIs for which no policies exist.
-   All blocked access attempts are logged in the ARP Violation Log table for administrator review.

**Note:** All policy records generated by ARP must be in the **Allowed** or **Denied** state before publishing to the Application Repository or the ServiceNow Store. Policies left in the **Requested** state block publication.

**Parent Topic:**[Configuring Application Runtime Policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/application-development/configuring-app-runtime-policy.md)