---
sourceDocument: Brazil Build or modify applications
sourceDocumentLink: https://www.servicenow.com/docs/r/application-development

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Build or modify applications

ft:clusterId :

    - cadev

bundleId :

    - cadev

workflow :

    - Development, Data, and Analytics


---

# Create a desktop action access rule

# Create a desktop action access rule {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read  
Configure rules to enforce security boundaries for AI agents in your organization. Resource access rules define which files, folders, websites, and applications AI Desktop Actions can access.

## Before you begin

This task must be performed in the ServiceNow instance.

Role required: sn_aia.admin

## About this task

The Desktop action resource access rule form includes fields for configuring the rule and a Policy related list for linking the rule to policies.

For more information about the default resource access rules available with the installation of the application, see [Default policy and rules](https://www.servicenow.com/docs/KNW8WEpAirNspo87QYnXqg#security_policy_governance_concept__default-policy-rules).

## Procedure

1. Navigate to AllAI Desktop ActionsDesktop Action Access Rules.  
   Access rules can also be created from the related list of a policy record, which links the rule to that policy.
2. Select New.
3. On the Desktop action resource access rule form, fill in the fields.  
   {#create-da-access-rule__table_y1z_b2w_hkc__entry__2}

   | Field | Description |
   |-|-|
   | Rule name | A descriptive name for the rule. Keep names specific to the resource or restriction so rules are easy to identify when linked to multiple policies. Example: Restrict Payroll Folder, Allow GitHub, Block Excel Files |
   | Active | Option to enable or disable the rule. Only active rules are evaluated during policy checks. |
   | Resource type | The type of resource this rule applies to: * File * Folder * Website * Application {#create-da-access-rule__ul_ghp_f2w_hkc} This determines which match type and permission options are available. |
   | Resource access | Whether the rule permits or blocks access: * Allow: AI agent can access the resource. * Deny: AI agent can't access the resource. {#create-da-access-rule__ul_ad1_n2w_hkc} Deny rules take precedence over Allow rules. If any rule explicitly denies access to a resource, the agent can't access it, regardless of any other Allow rules. If no rule matches a resource (neither Allow nor Deny), the AI agent prompts the user for the access during execution. To enforce strict security, create explicit Allow rules for only the resources AI agents should access. Example: If you have an Allow rule for `*.xlsx` (allow Excel files) and a Deny rule for `/payroll/**` (deny payroll folder), the AI agent can access `/documents/report.xlsx` but can't access `/payroll/report.xlsx`. |
   | Value | The resource identifier (path, URL, or app name) to match against. The format depends on match type and resource type. Example: /payroll/\*, \*.github.com, chrome, \*/Documents/\*.pdf |
   | Match type | Match types determine how the Value field is compared against actual resources on the user's system: * Exact: The value must match exactly (case-sensitive). Use for precise, single-item restrictions. Example: Value: `/payroll/salaries.xlsx` matches only that exact file, not `/payroll/salaries.pdf` or `/payroll`. Value: `github.com` matches only that exact domain. * Wildcard: The value must match with patterns using wildcards. Use `*` to match any characters at the current level (single directory or domain part). Use `**` to match any characters recursively across multiple directory levels. Works for file paths, folders, application names, and website domains. Example: Value: `**/*.log` matches `/tmp/app.log`, `/var/logs/app.log`, and any .log file anywhere. Value: `*.github.com` matches `api.github.com`, `user.github.com`, but not `github.io`. {#create-da-access-rule__ul_shd_k2w_hkc} Note: This field does not apply to the Application resource type. |
   | Permissions | The specific operations allowed: * Read: The AI agent has read-only access to the resource. * Create: The AI agent can read and create the resource. * Update: The AI agent can read, create, and update the resource. * Delete: The AI agent can read, create, update and delete the resource. {#create-da-access-rule__ul_ekd_s2w_hkc} Note: This field does not apply to the Application and Website resource type. |
   | Description | Description explaining what the rule controls, why it's necessary, and what resources are affected. Example: Denies automated access to payroll folder (/payroll/\*). Agents can't read, write, or execute files in this location. Finance team must manually handle payroll documents. |
   [ ]

   {#create-da-access-rule__table_y1z_b2w_hkc}
4. From the form header, select Save.
5. Link the rule to the policies.
   1. In the Policy related list, select Edit.
   2. From the Collection column, select the policies to add, then move them to the Policy List column.
   3. Select Save.
   {#create-da-access-rule__substeps_prw_rgw_hkc} {#create-da-access-rule__step-link-policy}
{#create-da-access-rule__step-link-policy}
6. Select Submit.

## What to do next

Execute adaptive desktop actions on your desktop. For more information, see [Execute adaptive desktop actions for desktop and web](https://www.servicenow.com/docs/Mu9aIowAtd4ECBu8RVmDnQ "Use AI Desktop Actions to automate desktop or web-based tasks. Describe your task to the AI agent, review and approve the execution plan, and monitor real-time progress.").

Take manual control of automation during execution. For more information, see [Take control of AI Desktop Actions execution](https://www.servicenow.com/docs/KC4m8A2HB0yqcCZGt4YK_Q "Take control and pause the execution that AI agent is running. Make manual changes to your desktop, and then resume execution by providing handoff notes to the AI agent.").

*[\>]: and then