Implementing Now Assist in domain separated environments can lead to increased complexity depending on your requirements. This guide documents this process according to the different scenarios one may encounter.
Note: This guide is valid from Yokohama Patch 6 and Zurich Path 0 onwards. You must have installed at least version 11.0.0 of the Generative AI Controller plugin to gain access to the Application Property domain.llm.usage.entitled mentioned in this guide.
What is Domain Separation?
Domain separation in the context of a ServiceNow instance refers to the creation of partitions within an instance that allow for data, processes, and administrative tasks to be kept separate, but with the ability to also access shared resources.
This will typically be used by Managed Service Providers (MSPs) to host multiple clients within the same instance, but it is also seen in global companies that wish to segment and customize instances per geography or division.
Learn more here: Understanding Domain Separation - Basics
What do I need to know when deploying Now Assist in a Domain Separated environment?
By default, Now Assist is enabled for all domains. The instance uses the Application Property value domain.llm.usage.entitled to determine if the Now Assist functionality can be used, with the value of True corresponding to permission for use and False restricting the usage. If set to false, all requests leveraging Now Assist features will be blocked. Do note that, even if the application property value is true for a domain, you still have to install, configure, and activate Now Assist within the Now Assist Admin console to utilize Now Assist features.
If one sets the value of domain.llm.usage.entitled to false for a domain, then all subsequent child domains will also be unable to use Now Assist.
This is documented in the video below:
How do I deploy Now Assist in my domain separated environment?
We have some recommendations based on different scenarios below:
Scenario #1: All domains can use Now Assist
You do not have to modify anything – Now Assist can be activated and configured at the TOP/Global domain, and these settings will cascade down to each child domain. Data access restrictions between domains are respected.
Scenario #2: Only the TOP/Global domain can use Now Assist - child domains cannot
- Navigate to the sys_application_property table
- Open the record for the domain.llm.usage.entitled application property
- Click New in the Application Property Values list
- Set the value of the new Application Property Value to false
- Set the value of the domain field to a child domain
- Click Submit
- Repeat steps 3-6 for each child domain that needs to have Now Assist restricted
Scenario #3: Only some child domains can use Now Assist
Scenario #3 follows the same pattern as Scenario #2, however, you only set application property values to false for the child domains you wish to deny access to Now Assist to. Do note that the value of domain.llm.usage.entitled needs to remain as true for the Global/TOP domain.
What happens when I restrict the usage of Now Assist for a domain with domain.llm.usage.entitled set to false?
Now Assist features will no longer be displayed to a user working on a record within that domain. This holds true even if your skill has been activated within the Now Assist Admin console.
Any attempts to utilize Now Assist via alternate methods, such as within Virtual Agent, the Now Assist panel, or deployment methods for custom skills, will result in a message indicating the user that the feature has been deactivated.
Is there a difference in functionality for domain-separated instances using Now Assist?
No – the functionality is the same, except data from across domains is not shared.
Can I deploy different configurations for each Now Assist feature on a domain-by-domain basis?
Yes, you may! The key to configuring this is to remember that skill configurations and activations cascade from the parent to the child domains. This means that when you activate a skill within the Now Assist Admin console at a parent domain level, it will also be activated for all child domains.
If you wish to edit the skill for a child domain, first change your domain to that target domain. Navigate to the Now Assist Admin console, and notice that when you attempt to edit a skill, you get the below message:
If you proceed, you will create a copy of the OOTB (Out of the Box) skill within your domain. Any modifications made within that skill will be active for that domain and will overwrite configurations set at a parent domain level. Subsequent child domains will also inherit the configured skill.
If you only activate a skill in a child domain, then do note that it will remain deactivated at the parent domain level.
How do I measure usage of assists per domain?
Assist consumption can be monitored within the Subscription Management module. Ensure you have at least version 5.1.0 of the Subscription Management v2 plugin.
Do note that usage is defined by which domain the user was in when they triggered the Now Assist feature. For example, if John Doe were in the global scope and triggered incident summarization on a record created in the Alpha subdomain, that assistance will still be attributed to the global domain.
Resources
- Product Documentation
- Domain Separation in Now Assist Admin
- Domain Separation and the Generative AI Controller
- Domain Separation and AI Search
- Domain Separation and Now Assist in Virtual Agent
- Support Articles
- Community
