---
sourceDocument: Australia Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/intelligent-experiences

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Domain separation and AI Control Tower

# Domain separation and AI Control Tower {#ariaid-title1}

Release version: Australia  
Updated August 20, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 8 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Domain separation and AI Control Tower

AI Control Tower enables enterprises to discover, govern, monitor, and measure AI systems across multiple business units or client tenants within a shared ServiceNow instance.
Domain separation allows logical grouping of data, processes, and administrative tasks into distinct domains, ensuring data isolation while enabling centralized administration.
This is particularly useful for managed service providers (SPs) managing multiple tenants, keeping each tenant's AI assets, risk posture, security data, and value calculations separate.
Show full answer Show less  

## Key Features

* **Basic support for domain separation:** Starting with the September release, AI Control Tower supports domain separation across all pillars: inventory and discovery, monitoring, risk, security, and value.
* **Domain hierarchy views:** Parent domains view combined data of their own and child domains; child domains see only their own data.
* **Configuration inheritance and overrides:** Settings like evaluation metrics, cost rates, and AI model provider configurations inherit defaults from parent or global domains but can be overridden per domain without affecting others.
* **Shared elements:** Playbook rules, templates, flows, and the AI Control Tower interface itself are shared across domains.
* **Data and behavior scoped per domain:** AI assets, monitoring data, risk assessments, security tasks, and value calculations are isolated to each domain, ensuring data privacy and proper access control.
* **Security and risk management:** Each domain maintains its own security posture and risk assessments, with parent domains having oversight over child domains' data.
* **Value management:** Domains calculate productivity gains and cost savings independently, with roll-ups available for parent domains.

## How Domain Separation Applies Within AI Control Tower Pillars

* **Inventory and discovery:** AI assets are distinct per domain; discovery connectors and external AI systems are assigned to the configuring user's domain, preventing cross-domain data visibility.
* **Monitoring:** Evaluation data, traces, and configuration are domain-specific. Metrics aggregate only data visible within the domain hierarchy.
* **Risk and compliance:** Risk tasks and assessments are scoped to the domain of the related AI asset. Dashboards and ratings reflect domain-specific data with roll-ups for parent domains.
* **Security:** Security tasks, asset scores, threat detections, and activity maps are domain-scoped. Some dashboard elements like top recommendations are replaced to accommodate domain separation limitations.
* **Value:** Productivity and cost savings calculations use domain-specific templates and rates that cascade from global to child domains, with override capabilities.
* **Strategy and planning:** AI investment demands, epics, goals, and product feedback remain confined to their originating domains and are hidden from others outside the domain hierarchy.

## Setting Up Domain Separation

Domain separation is configured at the instance level in ServiceNow. Applications that support domain separation, like AI Control Tower, inherit this configuration and operate within the domain-separated framework. This allows organizations to host multiple customers or tenants on a single instance while ensuring data isolation and access control per domain.

## Practical Benefits for ServiceNow Customers

* Maintain strict data isolation between tenants or business units within shared instances.
* Enable centralized administration with hierarchical visibility and control.
* Customize configurations and policies per tenant without impacting others.
* Ensure compliance and risk management are domain-specific, enhancing security posture.
* Accurately measure AI value and impact per domain with consolidated reporting for parent domains.  
Domain separation is supported for AI Control Tower. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

## Support level: Basic\* {#aict-domain-separation__section_m2k_ln5_fkc}

The
support level is Basic but has some exceptions or special conditions.{#aict-domain-separation__p_nsc_nfg_h1c}  
* Business logic: Ensure that data goes into the proper domain for the application's service provider (SP) use cases.
* The user interface, cache keys, reporting, rollups, and aggregations all use the domain at production run time.
* The owner of the instance must be able to set up the application to function across multiple tenants.
{#aict-domain-separation__ul_msq_t2x_zkb}

Sample use case: When an SP uses chat to respond to a tenant-customer's message, the client
must be able to see the SP's response.{#aict-domain-separation__p_psc_nfg_h1c}

For more information on support levels, see [Application support for domain
separation](https://www.servicenow.com/docs/access?context=domain-separated-apps&version=australia&pubname=australia-platform-security&ft:locale=en-US).{#aict-domain-separation__p_qsc_nfg_h1c}

## Overview {#aict-domain-separation__section_mby_nn5_fkc}

AI Control Tower helps you discover, govern, monitor, and measure the value of AI systems across your enterprise. If you manage multiple business units or client tenants from a shared instance, such as a managed
service provider, domain separation lets you keep each tenant's AI assets, risk posture, security data, and value calculations distinct while administering the deployment from a single instance.

Sample AI Control Tower use case: When a service provider (SP) configures a discovery connector for a client, the client is able to see all assets from their environment.

## How domain separation works in AI Control Tower {#aict-domain-separation__section_nby_nn5_fkc}

AI Control Tower provides Basic support for domain separation beginning with the September release, across all pillars: inventory and discovery, monitoring, risk, security, and value.

Some elements remain common across domains regardless of this support level: playbook rule and template definitions, flows, and the AI Control Tower interface itself are shared. The data and behavior described in the pillar sections later in this topic are specific to each domain.

Within a domain hierarchy, a parent domain's view generally combines its own domain with all of its child domains, while a child domain's view shows only that domain's own data. Configuration settings, such as evaluation metric
sample rates and cost framework rates, are inherited from a parent or global domain by default, and you can override a setting for a specific domain without affecting the global default or other domains.

## How to set up domain separation for AI Control Tower {#aict-domain-separation__setup}

The base system provides built-in functionality to separate an instance by domain. After an instance is domain-separated, any application that supports domain separation can be installed on that instance.

The application inherits and operates within the domain-separated setup, provided that the application itself supports domain separation.

For example, an organization can host Customer A and Customer B on the same instance, while logically separating their data and access by domain. Customer A can see only its own data, and Customer B can see only its own data.

For more information, see [Domain separation setup and administration](https://www.servicenow.com/docs/access?context=c_DomainSeparationSetup&version=australia&pubname=australia-platform-security&ft:locale=en-US).

## Use cases {#aict-domain-separation__section_oby_nn5_fkc}

The following sections describe how domain separation applies within each pillar of AI Control Tower.

## Inventory and discovery {#aict-domain-separation__section_domain-sep-inventory}

For inventory and discovery, domain separation keeps each domain's AI assets distinct while giving administrators at a parent domain oversight across their child domains.

* AI asset visibility follows the domain hierarchy. A user at a parent domain can see AI assets across all of its child domains, while a user at a child domain sees only the assets in that domain.
* Automated discovery and connectors create records in the domain of the user who configures the connector, so discovered AI systems and connections from both ServiceNow and external platforms are associated with the correct domain.
* External AI systems registered with an API key are added to the domain of the user who created the key. A warning helps prevent registering an asset in the wrong domain with a key issued to another domain.
* Automation rules and their templates show both the current domain's own records and any records inherited from a parent domain that haven't been overridden, but only the rules created within the current domain actually run.
* Asset tags are scoped by domain, so a tag created for an asset in one domain doesn't appear in another domain's asset views.

## Monitoring {#aict-domain-separation__section_domain-sep-monitoring}

For monitoring, domain separation ensures that evaluation data, trace history, and configuration changes for one domain never surface in another domain's view, even when the underlying AI agent is scoped globally.

* Aggregate evaluation metrics reflect only the domains a user can see: their own domain, any child domains, and the global domain. Metrics from sibling or parent domains are never included, even for a globally scoped AI agent.
* Traces and sessions are scoped to the domain of the user who generated them, not the domain of the AI agent. Running a globally scoped agent from within a specific domain still creates a trace that only that domain can see.
* Evaluation metric configuration, such as sample rates and trace API limits, is inherited from the global domain by default. Overriding a setting for a specific domain applies only to that domain and its children, without changing the global default or affecting other domains.

## Risk and compliance {#aict-domain-separation__section_domain-sep-risk}

For risk, domain separation isolates each domain's risk posture while letting administrators at a parent domain see and manage risk across their child domains.

* Risk assessment tasks and controls, such as impact assessments, attestations, and policy exceptions, are scoped to the domain of the related AI asset. A user sees the tasks assigned within their own domain plus any tasks in the global domain, but not tasks in sibling domains.
* Aggregate risk rating and classification for an asset reflect only the data in the currently selected domain, so a rating calculated for one domain's assets never includes another domain's data.
* Risk dashboards, including the regulatory risk classification, governance posture summary, and risk heat map, filter by the selected domain and roll up through the domain hierarchy. A parent domain's view combines its own data with all of its child domains, while a child domain's view shows only its own data.
* Asset intake and onboarding workflows keep related records, such as configuration items, business applications, and datasets, in the domain of the new asset. Approval routing and any tasks the onboarding playbook creates stay within that domain, so users in other domains don't receive related notifications.
* AI model provider and data privacy settings, such as which model providers are allowed and how data overflow is handled, are configured per domain. A change made in one domain's settings doesn't affect another domain's configuration, and using a model outside a domain's allowed list is blocked.

## Security {#aict-domain-separation__section_domain-sep-security}

Domain separation ensures that each domain's security posture reflects only its own AI assets and activity, while dashboards and metric detail pages still honor the domain hierarchy.

* The AI asset security score is calculated from the AI assets in the currently selected domain, so each domain's score reflects only its own assets.
* In the Activity Center, security tasks are scoped to the current domain, so a domain shows only the security tasks associated with assets in that domain.
* The agent map and access issue details inherit the domain of the underlying asset or agent. Viewing a parent domain includes the agents and access issues from its child domains.
* In Post-runtime metrics, threat detection data for both internal and external agents is scoped by domain, so the threat map and related guardrail data reflect only the current domain's activity.
* Your top recommendations don't appear on the security dashboard in domain-separated instances, because its underlying data isn't domain aware. Instead, a Security events detected section is shown.
* In Runtime metrics, Sensitive data input and Sensitive data anonymized metrics aren't shown for domain-separated instances.
* Details for Privileged AI agents, Dormant AI agents, Access issues, Security events detected, Agent map, Post-runtime, and AI asset security score include a Domain column showing the domain the AI asset belongs to.

## Value {#aict-domain-separation__section_domain-sep-value}

For value, domain separation lets each domain calculate productivity gains and cost savings using its own assumptions, while still rolling results up for domains that oversee multiple child domains.

* Value templates, the formulas used to calculate productivity gains for a managed AI system, can be inherited from a parent domain or overridden for a specific domain. Overriding a template in a child domain doesn't change the calculation for the parent template or other domains.
* Productivity gains and savings data roll up through the domain hierarchy. A parent domain's dashboard combines its own data with all of its child domains, while a child domain's dashboard shows only its own data.
* Cost framework rates cascade from the global domain to child domains by default. Administrators can override rates for a specific domain without changing the global rate or other domains' rates.
* Rate changes apply prospectively only. Savings and cost data already calculated under a previous rate aren't recalculated when the rate changes.

## Strategy and planning {#aict-domain-separation__section_domain-sep-strategy}

For strategy and planning, domain separation keeps AI investment demands, epics, and goals within the domain where they originate.

* AI investment demands, and the epics, goals, and stories created from them, stay in the domain where they were created. Domains outside that hierarchy can't see these records.
* Product feedback submitted for an AI asset, and any demand created from that feedback, stay in the same domain as the asset. Domains outside that hierarchy can't access the related records.
**Related topics**   

* [Domain separation for service providers](https://www.servicenow.com/docs/access?context=domain-sep-landing-page&version=australia&pubname=australia-platform-security&ft:locale=en-US)