---
sourceDocument: Brazil Enterprise Architecture
sourceDocumentLink: https://www.servicenow.com/docs/r/application-portfolio-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Enterprise Architecture

ft:clusterId :

    - appportman

bundleId :

    - appportman

workflow :

    - Technology


---

# Granular admin role changes in Enterprise Architecture

# Granular admin role changes in Enterprise Architecture {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Understand the transition from global admin usage to feature‑specific granular admin roles, outlining the intent, architectural principles, and governance expectations defined by the Granular Admin Directive.
Enterprise Architecture now standardizes on granular admin roles to ensure controlled, least‑privilege access while preserving backward compatibility for existing customers.

## What changed {#eaw-gran-admin-role-changes__section_vt3_nfr_m3c}

The global `admin` role is no longer referenced directly by application features or capabilities. Instead,

* Ff\\eature‑specific granular admin roles are introduced (for example, sn_apm.apm_admin, cost_transparency_analyst).
* Application modules, system properties, and applications reference only granular roles
* The `admin` role continues to function through role inheritance, ensuring upgrade safety and non‑breaking behavior.
{#eaw-gran-admin-role-changes__ul_ynj_vfr_m3c}

## Why this change {#eaw-gran-admin-role-changes__section_t5g_ggr_m3c}

Direct usage of the `admin` role for feature administration resulted in:

* Over‑privileged access models
* Increased security risk
* Tight coupling between unrelated features
* Limited ability to delegate administration safely
* Granular admin roles address these concerns by:
  * Enforcing least‑privilege architecture principles
  * Improving security and auditability
  * Enabling user‑controlled delegation
  * Preserving backward compatibility during upgrades
  {#eaw-gran-admin-role-changes__ul_jl1_4gr_m3c}
{#eaw-gran-admin-role-changes__ul_w2t_3gr_m3c}

## Standard role pattern {#eaw-gran-admin-role-changes__section_d51_vgr_m3c}

* `<feature>_admin` -- Full administrative control for a specific feature or capability
* `<feature>_read` -- Read‑only access for operational or reporting use
* `<feature>_user` -- Standard usage access
{#eaw-gran-admin-role-changes__ul_pgr_43r_m3c}

## Example granular roles for Enterprise Architecture {#eaw-gran-admin-role-changes__section_xqk_v3r_m3c}

* `sn_apm.apm_admin` -- Administers Enterprise Architecture features and configurations
* `sn_apm.apm_read` -- Read‑only access to Enterprise Architecture data
* `sn_apm.apm_user` -- Standard Enterprise Architecture user access
{#eaw-gran-admin-role-changes__ul_ucn_y3r_m3c}
**Related tasks**   

* [Install Enterprise Architecture Workspace](https://www.servicenow.com/docs/wrBTBstLvgavWGf6LZJ1Lw "Install the Enterprise Architecture Workspace application (sn_apm_ws)if you have the admin role.")