How is access to Application Menus and Modules controlled?

Roles are used to control access to applications and modules in the application navigator. Each application menu or module has a role field that specifies which role is required to view it. Users who do not have the specified role or a role that contains it will not see the application menu or module. Roles can also be used to control access to other features and capabilities in ServiceNow, such as tables, fields, scripts, and workflows.

References = Enable or disable an application menu or module, Grant a role access to applications and modules, Controlling access to applications and modules.