Content security in AI Search

  • Release version: Zurich
  • Updated July 31, 2025
  • 3 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Content security in AI Search

    AI Search in ServiceNow ensures that search results are filtered to show only records accessible to the currently logged-in user. Content security is automatically enabled and not configurable, protecting sensitive data by integrating access controls during both indexing and query execution phases.

    Show full answer Show less

    Key Features

    • Indexed Security Features: AI Search respects role-based field-level ACLs, non-scripted conditional ACLs, scripted table-level ACLs, Before Query business rules, domain separation, and user criteria for knowledge and catalog item records during indexing. However, it does not support scripted or conditional field-level ACLs.
    • Early Binding Security: The default and efficient security method that embeds security filters directly into search queries. It supports most ACL types except scripted table-level ACLs. If errors occur or scripted ACLs are detected, AI Search switches to late binding.
    • Late Binding Security: A fallback, more resource-intensive method that applies security filters after retrieving results by invoking the GlideRecord.canRead() method on each record. This method supports all indexed security features and can be enforced globally or per indexed source via system settings.
    • Facet Behavior with Late Binding: When late binding is applied to indexed sources linked to facets, filter selections only include values from the current result page, and search result counts may overstate visible results due to post-filtering.
    • External Content Security: AI Search maintains access permissions for external documents by mapping ServiceNow users to external users and groups. Security filters are built from these permissions to ensure consistent access control for external content.

    Key Outcomes

    • ServiceNow customers can trust AI Search to enforce access controls seamlessly, ensuring users only see authorized records in search results.
    • The dual security binding implementations provide a balance between performance (early binding) and comprehensive security coverage (late binding).
    • Customization options allow administrators to force late binding security when needed, providing flexibility for complex security requirements.
    • Access controls extend to external data sources, allowing secure indexing and searching of external content integrated into the AI Search platform.
    • Awareness of facet behavior and search result count discrepancies helps customers design accurate and user-friendly search interfaces.

    AI Search filters search query results and displays only records that the currently logged in user can access.

    Content security is automatically enabled and isn't configurable.

    Indexed security features

    When indexing records from ServiceNow AI Platform® tables, AI Search preserves the following access control settings:

    AI Search doesn't support scripted field-level ACLs or conditional field-level ACLs.

    Early and late binding security implementations for search queries

    At query time, AI Search filters search results by evaluating user access to indexed tables and records. The filtering implementation used depends on the security features present on tables and records that match the search query.

    Content security implementation Description
    Early binding Default content security implementation that incorporates security filters into the search query.

    The system adds relevant security filters for the user to each search query. To appear in the search results, records must match the search query and pass all security filters.

    Early binding security supports non-scripted ACLs, Before Query business rules, and domain separation, plus user criteria for records indexed from the kb_knowledge and sc_cat_item tables. If a search matches records that have table-level scripted ACLs, the search query automatically falls back to use late binding security.

    Note:
    If an early binding filter produces an error, the search query automatically falls back to use late binding security.
    Late binding More computationally expensive alternate content security implementation that post-filters search query results.

    The system applies security filters to the search query just as early binding security does. After retrieving records that match the filtered query, it invokes the GlideRecord.canRead() method for each record. To appear in the search results, records must match the search query, pass all security filters, and return true for the API method.

    Late binding security supports all indexed security features.

    By default, late binding security serves as a fallback mechanism for early binding security. You can override this default behavior in the following ways:
    • To make AI Search use late binding security for all results from an indexed source, set the value of that indexed source's Force Late Binding field to true.
    • To make AI Search use late binding security for all search results, set the value of the Force AI Search to use late binding for ACL evaluation ( glide.ais.security.force_late_binding ) system property to true.

    If AI Search applies late binding security to any results from an indexed source used by a facet, the list of available filter selections for the facet changes. When this happens, the facet only displays field values found in the current page of search results. For details on facets, see Create a facet in an AI Search application configuration.

    When you enable search result counts for facets in a search application, the counts indicate the number of results that matched the user's search. Late binding security can remove results after they’re counted, causing the actual number of displayed results to be lower than the count. For more information on search result counts for facets, see Show search result counts for facets on the results page for a search application.

    Content security for external content

    AI Search preserves access permissions when ingesting external documents. You can alias ServiceNow AI Platform users to the externally defined users and groups specified in these access permissions. AI Search constructs content security filters for external document records from these permissions and aliases.

    To learn about using AI Search with external data sources, see Indexing and searching external content in AI Search. For full details on external content security, see External content security for AI Search.