---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Step-up authentication

# Step-up authentication {#ariaid-title1}

Release version: Australia  
Updated November 5, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Step-up authentication

Step-up authentication enhances security for sensitive interactions with AI voice agents by requiring callers, who are already authenticated, to complete an additional verification challenge before proceeding.
This method allows callers to undergo a lighter verification initially for general requests and only complete a stronger challenge when accessing sensitive functions such as password resets or banking details.
Show full answer Show less  

## How Step-up Authentication Works

* **Prerequisite:** The caller must be initially authenticated before step-up authentication is triggered.
* **Trigger:** It activates when a caller reaches an AI voice agent that handles sensitive requests and requires step-up authentication.
* **Attempts:** Only one attempt is allowed; failure blocks the request and directs the caller to a configured fallback method.
* **Factor Reuse:** The same authentication factor used earlier (e.g., SMS OTP) can be reused but issues a new challenge code.
* **Scope and Duration:** One step-up factor is configured per voice assistant and applies across all relevant agents for the entire call.

## Configuration and Supported Factors

* Step-up authentication is enabled by default via the system property `glide.convaivoice.stepup.enabled`.
* Which AI voice agents require step-up is configured per agent in AI Agent Studio's Access rules section.
* The step-up authentication factor is selected on the Caller verification screen in AI Voice Assistant Designer. This requires the `authfactorsadmin` role.
* Supported factors for step-up include Okta Verify push notifications, SMS verification codes, and Authenticator app TOTP.
* Knowledge-based authentication, Soft PIN, and Email OTP are not supported for step-up but can be used for initial authentication.

## Combining Step-up with Other Factors

Step-up authentication acts as an additional layer after primary authentication factors. It does not replace initial factors but runs subsequently when required by an AI voice agent.

* Step-up factors can be the same as initial factors, with new challenges issued each time.
* Unsupported factors for step-up can still be used in earlier authentication steps.
* Example scenarios include mixing Soft PIN (first factor), SMS code (second factor), and Okta Verify push (step-up factor).

## Limitations

* Step-up authentication applies at the AI voice agent level, not at individual action levels.
* Only one step-up factor can be configured per voice assistant, shared by all agents requiring it.
* Only one attempt is allowed for step-up challenges.
* The elevated authentication state lasts for the call duration and cannot expire earlier or transfer across voice assistants or live agent handoffs.

## Availability Criteria

* The system property `glide.convaivoice.stepup.enabled` must be set to true.
* The chosen step-up factor must be configured at the platform level.
* The AI voice agent must be configured to require step-up authentication.
* A step-up factor must be selected for the voice assistant.  
Step-up authentication requires a caller who is already authenticated to complete an additional challenge before reaching an AI voice agent that handles a sensitive request.

## When to use step-up authentication {#step-up-authentication__when-to-use}

Without step-up authentication, every caller is verified once at the start of the call and keeps the same level of access for the rest of it. The verification required at the start therefore has to be strong enough for the most
sensitive request the caller might make later.

Step-up authentication separates the two. Callers complete a lighter verification to reach general
requests, and complete an additional challenge only when the call reaches an AI voice agent that handles a sensitive request, such as a password reset or access to bank account details.

## How step-up authentication works {#step-up-authentication__how-it-works}

A caller must already be authenticated before step-up authentication can run. If the caller's first request reaches an AI voice agent that requires step-up authentication, the caller must first complete configured identification
and authentication. The step-up challenge runs only after that authentication is complete.

Step-up authentication behaves as follows:
{#step-up-authentication__how-it-works__entry__2}

| Behavior | Detail |
|-|-|
| Trigger | On entry to an AI voice agent that requires step-up authentication. It applies to all the actions the agent performs. |
| Attempts | One attempt. If the caller doesn't complete the challenge, the request is blocked. The caller is then directed to the fallback method configured on the Safeguards screen in AI Voice Assistant Designer. |
| Factor reuse | The first or second authentication factor can be selected again for step-up. A new challenge is issued. For example, if SMS OTP is the configured authentication factor and the step-up factor, the caller receives a new code during step up attempt. The earlier code is not reused. |
| Scope | One step-up factor per voice assistant, shared by every AI voice agent in that assistant that requires step-up authentication. |
| Duration | Applies for the rest of the call. |
| System property | `glide.conv_ai_voice.step_up.enabled`, by default set to <kbd class="ph userinput">true</kbd>. |
[ ]

## Configuration {#step-up-authentication__configuration}

Step-up authentication requires two settings, configured on different screens.

* Which AI agents require step-up authentication is set per agent, in the Access rules section of AI Agent Studio. For more information, see [AI Agent Studio](https://www.servicenow.com/docs/access?context=aias-landing&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US).
* Which factor callers use for step-up authentication is set on the Caller verification screen in AI Voice Assistant Designer. For more information, see [Configure step-up authentication](https://www.servicenow.com/docs/2RBlMtcBfEuFbrAAt~sGHA "Configure step-up authentication to require an additional challenge before callers reach AI voice agents that handle sensitive requests.").

{#step-up-authentication__ul_k4k_cys_5kc}

If an AI voice agent requires step-up authentication and no step-up factor is selected for the voice
assistant, callers reaching that agent are directed to the configured fallback method.

## Supported factors {#step-up-authentication__supported-factors}

* Okta Verify push notification
* SMS verification code
* Authenticator app time-based One Time Password (TOTP)

{#step-up-authentication__ul_xtn_qvs_5kc}  
Note:  
Knowledge-based authentication (KBA), Soft PIN, and Email one-time password (OTP) aren't supported for step-up authentication.

## Combining step-up authentication with other factors {#step-up-authentication__combining-with-factors}

Step-up authentication is an additional layer on top of the factors configured for the voice assistant. It doesn't replace the configured authentication factor. It runs after them, and only when the call reaches an AI voice agent
that requires it.

The step-up factor is selected separately from the first factor and second factor:

* A factor used as the first factor or second factor can also be selected as the step-up factor. The caller receives a new challenge each time.
* A factor that isn't supported for step-up authentication isn't excluded from the earlier steps. Soft PIN, for example, can be the first authentication factor even though it isn't supported as the step-up factor.

{#step-up-authentication__ul_u25_5xt_5kc}

The following examples show how the three can be combined.
{#step-up-authentication__table_v25_5xt_5kc__entry__5}

| Example | First factor | Second factor | Step-up factor | What the caller experiences |
|-|-|-|-|-|
| A different factor at each step | Soft PIN | SMS verification code | Okta Verify push notification | The caller completes the step-up challenge with an Okta Verify push notification after reaching an AI voice agent that requires it. |
| The same factor reused for step-up authentication | Soft PIN | SMS verification code | SMS verification code | The caller receives a new verification code rather than reusing the code sent earlier in the call. |
[ ]

{#step-up-authentication__table_v25_5xt_5kc}

## Limitations {#step-up-authentication__limitations}

* Step-up authentication applies at the AI voice agent level. It can't be applied to individual actions within an agent.
* One step-up factor is configured per voice assistant. Every AI voice agent in that assistant that requires step-up authentication uses the same factor.
* Step-up authentication is one attempt. The retry setting in Advanced options applies to first factor and second factor authentication only.
* The elevated state applies for the duration of the call and can't be configured to expire earlier.
* The elevated state isn't carried across voice assistants and isn't transferred when the call is handed off to a live agent.
{#step-up-authentication__ul_ytn_qvs_5kc}

## Availability {#step-up-authentication__availability}

Step-up authentication is available for AI voice agents when the following conditions are met:

* The `glide.conv_ai_voice.step_up.enabled` system property is set to `true`.
* The factor you want to use for step-up authentication is configured at the platform level. For more information, see [Authentication factors](https://www.servicenow.com/docs/dT~H3ZyYl1qdDrtuRO6e7Q "Authentication factors are the elements used for caller identification and authentication. In secure voice agent environments, the process begins with identifying the caller, followed by authenticating their identity before granting access. A robust security strategy combines multiple factors to confirm that only authorized users interact with AI voice agents.").
* The AI voice agent is set to require step-up authentication in the Access rules section of AI Agent Studio.
* A step-up factor is selected for the voice assistant on the Caller verification screen in AI Voice Assistant Designer. To make this selection, you need the `auth_factors_admin` role.
{#step-up-authentication__ul_szl_myt_5kc}
**Related concepts**   

* [Authentication factors](https://www.servicenow.com/docs/dT~H3ZyYl1qdDrtuRO6e7Q "Authentication factors are the elements used for caller identification and authentication. In secure voice agent environments, the process begins with identifying the caller, followed by authenticating their identity before granting access. A robust security strategy combines multiple factors to confirm that only authorized users interact with AI voice agents.")  
**Related tasks**   

* [Configure step-up authentication](https://www.servicenow.com/docs/2RBlMtcBfEuFbrAAt~sGHA "Configure step-up authentication to require an additional challenge before callers reach AI voice agents that handle sensitive requests.")  
**Related topics**   

* [Identify and authenticate the caller](https://www.servicenow.com/docs/access?context=configure-voice-assistants&version=australia&pubname=australia-conversational-interfaces&ft:locale=en-US)