--- sourceDocument: Australia Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance Release : - australia ft:locale : - en-US ft:publication_title : - Australia Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Entity Based Access for AI assets # GRC: Entity Based Access for AI assets {#ariaid-title1} Release version: Australia Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of GRC: Entity Based Access for AI assets The GRC: Entity Based Access (EBA) application is designed to provide granular, entity-level access control for AI asset records within the AI Risk and Compliance framework. It ensures that sensitive AI risk and compliance data is accessible only to authorized users based on organizational entities such as departments or business units, rather than broader role-based access. This approach helps maintain data confidentiality while preserving core entity visibility for all users. Show full answer Show less ## Key Features * **Granular Data Access:** Controls access to AI systems, tasks, and related records by business entities, enabling precise segregation of sensitive information. * **Entity Visibility:** All users can see the entities themselves, but access to linked records is restricted to authorized users only. * **Supported Tables:** Access can be configured for AI system, AI system entity mapping, and AI system tasks tables. * **Configurable Entity Classes and Types:** Entities created with AI assets are assigned entity classes (e.g., AI system, AI model, dataset) which must be configured to enforce access restrictions properly. * **Bulk and Automatic Access Management:** Provides guided utilities to set access restrictions on existing records in bulk and rules to automatically apply restrictions on new records. * **Default Field Configurations:** Certain user and group fields are predefined on AI Asset and AI Asset task records to support access control. ## Practical Application for ServiceNow Customers ServiceNow customers can leverage the GRC: Entity Based Access application to enhance security around AI asset data by defining access controls tightly aligned with business entities. This enables compliance managers and risk owners to view and manage AI risk and controls data relevant to their specific organizational segment, ensuring sensitive information is protected while maintaining necessary operational visibility. The application requires installation and configuration of entity classes, types, and access rules, which facilitates ongoing controlled access management within AI governance processes. ## Next Steps * Install the GRC: Entity Based Access application. * Enable and configure entity-based access properties for AI assets and related objects. * Set up entity classes and types according to AI asset categories. * Use bulk update utilities and record access rules to enforce and maintain access restrictions. The GRC: Entity Based Access application enables you to segregate data on the AI asset records to ensure that only authorized users can access sensitive AI Risk and Compliance data while maintaining visibility into core entities. Entity-based access administrators can use this application to set up secure, controlled access to various AI assets and its related objects. ## GRC: Entity Based Access for AI assets {#entity-based-access-for-ai-assets__section_ccr_f4n_lhc} Entity-Based Access (EBA) is a security feature designed to provide granular, data-level access control within AI Risk and Compliance application. Unlike role-based access control, EBA decides which records a user can access based on business entities such as departments, regions, or business units. This approach ensures that sensitive information is only accessible to authorized users, aligning with organizational compliance and confidentiality requirements. [AI Risk and Compliance](https://www.servicenow.com/docs/lABgtu7kC5R6aI8cUZNZAw "The ServiceNow AI Risk and Compliance application, along with the ServiceNow AI Control Tower, enables the risk and compliance managers to ensure that the organizations comply with the regulations and policies with respect to their AI systems.") managers can access risks, controls, related entities, issues, indicators, AI asset tasks, risk assessments, attestations, and AI assets data through entity-based access. Entities themselves stay visible to all users, while visibility of linked records is limited to authorized users. When a user is qualified based on these configurations and has the minimum required roles, they have access to the following tables: * AI system \[sn_grc_ai_gov_ai_system\] * AI system entity \[sn_grc_ai_gov_ai_system_entity_map\] * AI system task \[sn_grc_ai_gov_ai_system_task\] {#entity-based-access-for-ai-assets__ul_nzm_kt4_lhc} ## Configure GRC: Entity Based Access {#entity-based-access-for-ai-assets__section_rgv_p5h_mhc} The following tasks must be performed to enable and use GRC: Entity Based Access for the AI asset records. 1. Install the GRC: Entity Based Access application. For more information, refer to [Install the Entity Based Access application](https://www.servicenow.com/docs/ohzoE4kpqt8fOk9j6_~AFQ "Install the GRC: Entity Based Access application."). 2. Enable or disable the entity-based Access properties to control access to the objects that are associated with an AI asset. For more information, refer to [Set up Entity Based Access properties](https://www.servicenow.com/docs/VMYIcaJ6XDVn49vvJdaLGg "Enable or disable the Entity Based Access properties to control access to the objects that are associated with an entity."). 3. Configure an entity class for a linked object by using the GRC: Entity Based Access application. For more information, refer to [Configure an entity class for a linked object](https://www.servicenow.com/docs/mbD_dI85IOtcE3suIrMkIg "Configure an entity class for a linked object by using the Entity Based Access application. You can define an entity class, such as Business Process, Business Service, or Database, and manage the object access for the entity that is linked to that entity class."). Note: Entities created with an AI asset are assigned an entity class such as AI system, AI model, or dataset depending on their category. To apply access restrictions to these entities, you must configure the appropriate entity class settings. 4. Configure an entity type by using the GRC: Entity Based Access application. For more information, refer to [Configure an entity type for a linked object](https://www.servicenow.com/docs/n7V1YF2imDO9gSQLbjvKag "Configure an entity type by using the Entity Based Access application. You can specify an entity type, such as Company or Vendors, and manage the object access for the entity that is linked to that entity type."). 5. Set access restrictions for the existing records in bulk by using the entity-based record access update utility guided-experience. For more information, refer to [Set access restrictions using an entity based record access update utility](https://www.servicenow.com/docs/hnNRM0P3is~9tAN1K3HK9Q "Set access restrictions for the existing records in bulk by using the Entity based record access update utility guided-experience. Use the workflow to enable or disable access to record types."). 6. Configure entity-based record access rules on record types to apply access restrictions to new records automatically. For more information, refer to [Configure entity-based record access rules](https://www.servicenow.com/docs/Wl6HMcEStASmeFE2d4oDJw "Configure entity-based record access rules on record types to apply access restrictions to new records automatically."). Note: Three records are provided by default, each with specific field configurations. The AI Asset record (sn_grc_ai_gov_ai_system) includes Analyst and Business owner as user fields, and Analyst Group as a group field. For AI Asset task (sn_grc_ai_gov_ai_system_task), you can find Assigned to and Watch list as user fields. The Related Entity record (sn_grc_ai_gov_ai_system_entity_map) doesn't have any user or group fields configured by default. {#entity-based-access-for-ai-assets__ol_gcq_5vh_mhc} **Related concepts** * [AI systems](https://www.servicenow.com/docs/gIz~NmGxHM_t4mNtGmnnEg "An AI system is an AI-powered solution that is developed, deployed, and managed under a formal governance framework. This framework ensures that the system operates in a responsible, compliant, and risk-aware manner throughout its life cycle.") * [AI assets](https://www.servicenow.com/docs/sQiu8m2UI6HDkPxCVTdzZA "An AI asset is a digital resource that leverages artificial intelligence technologies to perform specific functions or address defined business needs.")