Created UI policy on incident form, action set's cmdb_ci field as mandatory and script as not. result, field was not mandatory.
A UI Policy's Actions execute before the UI Policy's Scripts. Actions are predefined operations that can be applied to fields or sections, such as making them mandatory, read-only, visible, or setting a default value. Scripts are custom JavaScript code that can be used to perform more complex logic or validations. Actions are executed first, and then Scripts are executed if the UI Policy conditions are met. Reference: [ServiceNow Docs - UI policy actions], [ServiceNow Docs - UI policy scripts]

https://docs.servicenow.com/bundle/tokyo-application-development/page/script/useful-scripts/reference
/r_DisplayFieldMessages.html

https://docs.servicenow.com/bundle/tokyo-application-development/page/build/applications/concept/c_Applicati

In ServiceNow, Access Controls (ACLs) determine the permissions required for users to access or modify data. For a user to pass an Access Control, the following conditions must be met:
* Conditions configured in the Access Control must evaluate to true: Access Controls can have specific conditions set in the "Condition" field. These conditions are evaluated against the current record, and must return true for the Access Control to grant access.
* The user has one of the roles specified in the Required roles related list: Access Controls can specify certain roles that a user must possess to gain access. If the user holds at least one of these roles, this criterion is satisfied.
* Scripts configured in the Access Control must evaluate to true: Access Controls can include scripts that perform more granular checks. The script must execute without errors and return true for the user to pass the Access Control.
Option A is incorrect because Business Rules do not grant access; they are server-side scripts that execute based on record operations but do not control security permissions.
Option D is misleading. Each Access Control is evaluated independently. While multiple Access Controls can apply to a single operation, passing one does not inherently grant access unless it is the most specific match.
For more detailed information, refer to the official ServiceNow documentation on Access Controls:
servicenow.com