In the Application Navigator, visibility is evaluated at both the application menu level and the module level. A module can specify roles in its Roles field, but when that module Roles field is empty, the module does not add additional role requirements by itself. Instead, the user must still be able to see the application menu that contains the module. That means the effective gate becomes the application menu's access configuration (including any required roles on the application menu). As a result, the module is visible to users who already have access to the application menu, because the module is not restricting access further.
This behavior supports clean navigation design: define broad access at the application menu level, and only add module-level roles when you need to hide specific modules within an otherwise visible application menu.
Options like "snc_internal" or "users with no roles" are not universally correct because module visibility is not determined by those conditions alone. The key rule is: if module Roles is empty, application menu access controls whether users can see the module.

To receive email notifications, a user must have an active account and a valid email address in the user record.
If either of these conditions is not met, the user will not be able to receive any email notifications from the system.
References:
* Create an email notification
* Example scripting for email notifications

An Access Control list (ACL) defines what data users can access and how they can access it in ServiceNow tables1. The ACL evaluates the user roles and the conditions defined in the ACL rules to determine the user's access level2. In this case, the ACL rules for the table are as follows:
table.None read Access Control for users with the admin and itil roles: This means that users with the admin or itil roles cannot read any field in the table unless there is a more specific rule that grants them access3.
table. * read Access Control for users with the admin role: This means that users with the admin role can read all fields in the table.
table. field3 read Access Control for users with the itil role: This means that users with the itil role can read only the field3 in the table.
Therefore, a user with the itil role can read only the field3 in the table, and not the other fields.
Reference = 1: Access Control Lists - ServiceNow Docs 2: How ACL Rules Are Evaluated - ServiceNow Docs 3: Access Control List Rules - ServiceNow Docs : Wildcard in ACL Rules - ServiceNow Docs : Field-Level ACL Rules - ServiceNow Docs