---
sourceDocument: Australia Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/intelligent-experiences
Release :
- australia
ft:locale :
- en-US
ft:publication_title :
- Australia Enable AI
ft:clusterId :
- platai
bundleId :
- platai
workflow :
- Platform
---
# Create a connector scope
# Create a connector scope for an Arc policy {#ariaid-title1}
Release version: Australia
Updated October 22, 2026
 2 minutes to read
Limit what ServiceNow Arc can do through a connector, such as reading mail without sending it, by granting only the connector operations a team needs.
## Before you begin
Role required: sn_ai_governance.ai_steward and sn_app_arc.admin
## About this task
A connector scope names one operation, such as sending email, that Arc can perform through a connector. The scopes a policy grants apply on top of the user's own connection credential, so Arc can't use a permission the credential has unless the policy grants the matching scope. Users can turn off scopes you grant, but they can't turn on a scope you haven't granted.
The Active and Approval gate settings belong to this policy only. Other policies that use the same scope keep their own settings.
## Procedure
1. Navigate to AllAI Control TowerHomeGovernPoliciesArc policies.
2. Select the policy you want to update.
3. Select More.
4. Select Connector scopes.
5. Select Create connector scopes.
If the policy already has connector scopes, select + Add rule instead.
6. On the form, fill in the fields.
{#gov-pol-arc-create-connector-scope__table_connector_scope_fields__entry__2}
| Field | Description |
|-|-|
| Scope Name | Identifier Arc matches against the connector's permissions at run time. Enter it exactly as the connector defines it, for example, Mail.Send for the Microsoft 365 permission to send email. |
| Scope Label | Readable name that identifies the scope in lists, for example, Send Outlook emails. |
| Connector | Connector the scope applies to. * Browser * GitHub * Google Workspace * Microsoft 365 * Microsoft Teams * ServiceNow |
| Description | What the scope permits, for other administrators who review it later, for example, Allows the app to send emails on behalf of the user. |
| Active | Option to grant the scope to the users this policy covers. Cleared by default. Select it, or the scope doesn't take effect. |
| Approval gate | Option to require users to approve the scope before Arc uses it with the connector. Cleared by default. Select it for scopes that send, write, or change data on the user's behalf. |
[Table 1. New Connector scopes side panel]
{#gov-pol-arc-create-connector-scope__table_connector_scope_fields}
7. Select Create.
## Result
The scope appears on the policy's Connector scopes tab with its Active and Approval gate settings, and applies to the users the policy covers at their next policy
sync.
## Example: Let the agent send email only with approval {#gov-pol-arc-create-connector-scope__example-send-mail-approval}
Your account managers want Arc to draft and send customer follow-ups from Outlook, but sending should wait for the account manager's approval. Create a connector scope with the following values:
* Scope Name: Mail.Send
* Scope Label: Send Outlook emails
* Connector: Microsoft 365
* Description: Allows the agent to send email on the user's behalf, with approval.
* Active: Selected
* Approval gate: Selected
The scope name must match the Microsoft 365 permission exactly. Active grants the scope, and Approval gate makes users approve the scope before the agent uses it to send. Without this scope, the agent
can't send email for these users, even if their Microsoft 365 connection allows it.
*[\>]: and then