In ServiceNow User Criteria (used for Service Catalog Items, Categories, and Knowledge Bases), the security logic follows a " deny-first " or " restriction overrides permission " model.

The Rule: If a user matches the criteria defined in the Not Available For list, they are denied access immediately, regardless of whether they also appear in the Available For list.

Logic: Not Available For > Available For .

This ensures that security restrictions are strictly enforced. For example, you might make a category Available to " All Employees " but Not Available to " Contractors. " If a user is both (e.g., an employee record exists but they are tagged as a contractor group), the restriction blocks them.