Enforcing the separation
Consider your ServiceNow applications as a room (or floor) within a building (what an original metaphor, right?). While open-plan living is sometimes an advantage, it doesn't afford much privacy. Sometimes you want a door (and lock) to stop people wandering in and out of your room.
The ServiceNow platform gives you control. It acts as the application's doorman, deciding what comes in and what can go out. We'll see that there are many ways to be specific about how apps can affect each other. This is especially important when you install apps you haven't developed yourself.
Whenever the platform performs an action, it checks to see if it crosses a scope boundary. If a script was run in an IT scope, it will have access to all the tables and data that belong to the IT app. But it may not have access to data in the HR scope. The scope acts as the containing bubble; if all the elements have the same scope, it's fine. But the doorman will intervene if it crosses the boundary...
