“Define data access” on AI agent always shows as empty

[mahasnow15]

Hi All,
I’ve configured a few AI agents in ServiceNow for my use cases. For one specific agent, I’m seeing an issue when defining Data Access—the selection of roles always ends up empty after I set it.

This agent is invoked from an AI Workflow. Has anyone seen this behavior before, or have suggestions on what might cause the Data Access configuration to clear out?

Thanks.

[Vikram Reddy]

Hello @mahasnow15,

This is almost always role masking fighting you, the access control layer added for AI Agents in Zurich Patch 4 / Yokohama Patch 11. Role masking applies top down: agentic workflow (use case) first, then the AI Agent, then any Skill tools it calls, and each level can only retain roles that are a subset of the level above it. Since this agent is invoked from an AI Workflow, if that workflow's own role mask doesn't include the roles you're trying to set on the agent, the Data Access selection has nothing to reconcile against and gets wiped back to empty on save.

• Run as: check whether the agent is set to Dynamic user (inherits the invoking user's roles) or AI user (fixed, preconfigured roles)
• Role masking on the parent AI Workflow: open the use case and confirm the roles you want on the agent are actually present in its mask
• If the roles genuinely need to differ from the invoking user, switch the agent to an AI user with those roles pre-assigned, that sidesteps the masking dependency entirely

If it's still clearing out after that, tell me your patch level and whether it's a Dynamic user or AI user setup and I'll dig further.

References

• Latest access control security enhancements for AI Agents and Skill Kit [Updated Zurich Patch 4]

Thank you,
Vikram Karety
Octigo Solutions INC