---
sourceDocument: Australia Retail Industry
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/retail-industry

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Retail Industry

ft:clusterId :

    - rahi

bundleId :

    - rahi

workflow :

    - Customer and Industry


---

# Retail MCP Server roles and data access

# Retail MCP Server roles and data access {#ariaid-title1}

Release version: Australia  
Updated September 23, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Access to the Retail MCP Server is controlled at two levels: roles determine who can invoke each tool, and the caller's own record access determines what data each tool returns or changes.

## Roles that can invoke the tools {#rahi-retail-mcp-server-access-control__rahi-retail-mcp-server-access-control-roles}

The Retail MCP Server creates no roles. Each tool has an access control of type `flow_action` with the `invoke_from_ai` operation, named after the tool. A caller without one of the listed roles is denied, and the tool doesn't run.
{#rahi-retail-mcp-server-access-control__table_rtl_mcp_roles__entry__2}

| Role | Tools |
|-|-|
| sn_retail.associate_contributor, sn_retail.associate_fulfiller | Get my retail store, Get store devices |
| sn_rtl_stre_servcs.contributor | Create store break-fix case, Create store inquiry case, Get my store services cases, Update store services case |
[Table 1. Roles by tool]

{#rahi-retail-mcp-server-access-control__table_rtl_mcp_roles}

These roles aren't granted, by design:

* sn_retail.support_agent. A support agent assists retail customers and partners rather than working in a store. An administrator can add this role to the access control if needed.
* Store Services HQ agent roles, such as sn_rtl_stre_servcs.agent and sn_rtl_stre_servcs.breakfix_agent, and their manager variants. HQ agents work cases in the agent workspace; these tools expose only store-side actions.

## Data visibility {#rahi-retail-mcp-server-access-control__rahi-retail-mcp-server-access-control-data}

Each tool runs as the calling user and reads and writes data through secure queries, so the platform's existing access controls apply to the caller. A tool returns only the stores, devices, and cases the caller can read in the platform, and a write is refused if the caller can't write the case. The Retail MCP Server adds no record-level access controls of its own. Store and case tools identify the caller from the session, never from an identifier the assistant supplies.

## What the update tool can change {#rahi-retail-mcp-server-access-control__rahi-retail-mcp-server-access-control-update}

Update store services case is the only tool that changes existing records. It supports these actions, and nothing else:
{#rahi-retail-mcp-server-access-control__table_rtl_mcp_update_actions__entry__3}

| Action | Effect | Allowed when the case is |
|-|-|-|
| `get_actions` | None (read only) | Any state |
| `comment` | Adds a comment | New, Open, or Awaiting Info |
| `accept_resolution` | Adds a comment and sets the case to Closed | Resolved |
| `reject_resolution` | Adds a comment and sets the case to Open | Resolved |
| `close` | Sets the case to Closed with a resolution code and close notes chosen by the system | New, Open, or Awaiting Info |
[Table 2. Update store services case actions]

{#rahi-retail-mcp-server-access-control__table_rtl_mcp_update_actions}

Callers can't set the state directly, or the priority, assignee, assignment group, or resolution code. Closed and Cancelled cases reject every action. The rules match the ones the portal and mobile app apply.
**Related concepts**   

* [Retail MCP Server](https://www.servicenow.com/docs/o7dFGR4jPUmRgZSSh2_LBg "The Retail MCP Server exposes Retail Service Management capabilities as Model Context Protocol (MCP) tools, so store staff can find their store and devices and raise, track, and update Store Services cases from their AI assistant.")  
**Related tasks**   

* [Respond to resolutions through Portal or Mobile](https://www.servicenow.com/docs/P5CZCm9IZF21QMEaCmr8Ag "Review proposed resolutions and respond by accepting, rejecting with a reason, or self-closing your case. Available only when case is in \"Resolution Proposed\" state.")  
**Related reference**   

* [Retail MCP Server tools](https://www.servicenow.com/docs/~BNcBi_Rrx29Yf63s4wT7A "The Retail MCP Server provides six tools. Each entry lists the tool's purpose, inputs, what it returns, whether it changes data, and what it requires.")