---
sourceDocument: Yokohama ServiceNow AI Platform Administration
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/platform-administration

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama ServiceNow AI Platform Administration

ft:clusterId :

    - platadm

bundleId :

    - platadm

workflow :

    - Platform


---

# Read-only role

# Read-only role {#ariaid-title1}

* Release version: Yokohama
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read

The read-only role (snc_read_only) restricts a user or a group of users to read-only access on the tables to which the user already has access.

This role is designed to complement other roles a user possesses. Its purpose is to restrict actions like the insert, update, or delete operations on the tables accessible through their existing roles.

After you assign this role to a user, they can no longer create, update, or delete records on
ANY tables.  
Note:  
Assign this role only to users. Don't assign this role to other resources in the system, including applications, access control levels (ACLs), and so on.

The snc_read_only role can be assigned to any user to limit access to data without having to create ACLs for system tables, custom tables, and fields. This practice is useful for performing internal or external
audits without enabling a user to have insert or update access to data.  
Users with the snc_read_only role have the following restrictions regardless of other roles and privileges that they have.

* Can't insert, update, or delete records from the UI or when using the GlideRecord API.
* Can't activate or upgrade plugins.
* Can't directly run SQL.
* Can't upload XML files.
* Can only run background scripts when on an instance in the public sandbox environment.
{#c_ReadOnlyRole__ul_v1z_vdq_yq}  
Note:  
These role restrictions are in place even if impersonating another user with write access such as an admin.

## Exempt tables from the read-only restriction {#c_ReadOnlyRole__section_exempt_tables}

Three system properties control which tables users with the snc_read_only role can still create, update, or delete records on. These properties are not created on instances by default. To use them, manually
add each property to the System Properties \[sys_properties\] table and set the value to a comma-separated list of table names. See [Add a system property](https://www.servicenow.com/docs/otMgp3UdZkTqNnm5uEsqrQ "Add or create a property to control system behavior.").
{#c_ReadOnlyRole__table_exempt_props__entry__2}

| Property | Description |
|-|-|
| glide.security.snc_read_only_role.tables.exempt_create | Comma-separated list of tables on which users with the snc_read_only role can create records. |
| glide.security.snc_read_only_role.tables.exempt_write | Comma-separated list of tables on which users with the snc_read_only role can update records. |
| glide.security.snc_read_only_role.tables.exempt_delete | Comma-separated list of tables on which users with the snc_read_only role can delete records. |
[Table 1. snc_read_only exempt table system properties]

{#c_ReadOnlyRole__table_exempt_props}

## Activate the read-only role {#ariaid-title2}

If it isn't already active, an administrator can activate the Read-Only User Role (com.snc.read_only.role) plugin.

### Before you begin

Role required: admin

### Procedure

1. Navigate to AllSystem ApplicationsAll Available ApplicationsAll. {#t_ActivateTheReadOnlyRole__find-plugins-cmd}
2. Find the Read-Only User Role (com.snc.read_only.role) plugin using the filter criteria and search bar.  
   You can search for the plugin by its name or ID. If you cannot find a plugin,
   you might have to request it from ServiceNow
   personnel.{#t_ActivateTheReadOnlyRole__p_cb1_nfg_h1c}
3. Select Install to start the installation process.  
   Note:  
   When domain separation and delegated admin are enabled in an instance, the administrative user must be in the global domain. Otherwise, the following error appears: Application installation is unavailable because another operation is running: Plugin Activation for \<plugin name\>.
   You will see a message after installation is completed. For information about the components installed with a plugin, see [Find components installed with an application](https://www.servicenow.com/docs/6FbhsNcr_bOzoWCgJ_V_eg "Activating a plugin installs an application on your instance. Each application consists of components such as tables, user roles, and scheduled jobs. To view all components that are installed with an application, see the Application Files table.").
{#t_ActivateTheReadOnlyRole__steps_nw4_22z_rmb}

## Read-only role properties {#ariaid-title3}

These system properties control the snc_read_only role. The following default
values are used for the properties.
{#r_ReadOnlyRoleProperties__simpletable_tqr_1hx_4zb__entry__2}

| Name | Description |
|-|-|
| glide.security.snc_read_only_role.tables.exempt_create | Specifies which tables are exempt from the read-only role enforcement and enable the creation of new records. * Type: string * Default value: sys_user_session, sysevent, syslog, syslog_transaction, sys_user_preference, sys_ui_list, sys_ui_list_element, sys_db_cache, user_multifactor_auth * Location: System Properties \[sys_properties\] table {#r_ReadOnlyRoleProperties__ul_b1l_dgq_yq} |
| glide.security.snc_read_only_role.tables.exempt_write | Specifies which tables are exempt from the read-only role enforcement and enable the updating of existing records. * Type: string * Default value: sys_user_session, sysevent, syslog, syslog_transaction, sys_user_preference, sys_ui_list, sys_ui_list_element, sys_db_cache, user_multifactor_auth * Location: System Properties \[sys_properties\] table {#r_ReadOnlyRoleProperties__ul_l51_fgq_yq} |
| glide.security.snc_read_only_role.tables.exempt_delete | Specifies which tables are exempt from the read-only role enforcement and enable the deletion of existing records. * Type: string * Default value: sys_user_preference, sys_ui_list, sys_ui_list_element, sys_db_cache, user_multifactor_auth * Location: System Properties \[sys_properties\] table {#r_ReadOnlyRoleProperties__ul_fpd_fgq_yq} |
[Table 2.]

{#r_ReadOnlyRoleProperties__simpletable_tqr_1hx_4zb}

After you configure these properties, assign the read-only role as needed. When you log in, you're restricted from creating, updating, or deleting records on ANY tables unless you modified these properties.  
Note:  
Test the read-only role by assigning it to a user and then impersonating that user.

*[\>]: and then