---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Agent Access Role Configuration

# Configure role masking for an AI agent {#ariaid-title1}

Release version: Australia  
Updated November 5, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Restrict the roles that an AI agent uses at runtime by creating an Agent Access Role Configuration record that limits the agent to a defined set of roles.

## Before you begin

Role required: <kbd class="ph userinput">sn_aia.admin</kbd>

Before you configure role masking for an AI agent, the AI agent you want to restrict must already exist.

## Procedure

1. Navigate to the sys_agent_access_configuration_list.do table.  
   The Agent Access Role Configurations page opens.
2. Select New.  
   The Agent Access Role Configuration - New Record form opens.
3. On the form, fill in the fields:  
   {#configure-role-masking__table_xxz_1jl_pjc__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name for the configuration. Example: <kbd class="ph userinput">Action Designer role mask</kbd>. |
   | Application | Scope of the application. |
   | Description | Description of the configuration. |
   | Agent Table | Table that holds the agent record to restrict. |
   | Action | Limit To Roles. This action restricts the AI agent to the roles you add to the configuration. The agent can't use roles outside the selected roles. |
   | Agent | AI agent that the configuration applies to. |
   | Role List | Roles to limit, added using the Agent access roles list. Each role added through this lookup is stored as an individual record in the Configuration table. Note: * Use the Agent access role table to add roles. * Existing records with the `role_list` column continue to operate as expected. All new role configurations are implemented through the `sys_agent_access_role_mapping` table. {#configure-role-masking__ul_xsx_1cz_tjc} |
   | Agent access role | Role to add, selected using the Insert a new row. Each row you add creates one record in the Agent access roles table, linking the AI agent to that role. |
   [Table 1. Agent Access Role Configuration form]

   {#configure-role-masking__table_xxz_1jl_pjc} Figure 1. Agent Access Role Configuration
4. Select Submit.
{#configure-role-masking__aia-role-masking-configure-steps}

## Result

The platform saves each role masking entry in the Agent Access Role Configurations page. The next time the AI agent runs, it uses the roles that are mapped to an agent.