---
sourceDocument: Brazil Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/intelligent-experiences

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Access Analysis Agent

# Access Analysis AI Agent {#ariaid-title1}

Release version: Brazil  
Updated November 5, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read  
The Access Analysis Agent lets you ask whether a user, group, or role can access something on your ServiceNow instance. It uses guided, conversational workflows in the ServiceNow Otto® panel.

## Access Analysis Agent overview {#access-analysis-agent__section_aaa_overview}

The agent evaluates whether a user, group, or role can access a table, record, field, Client Callable Script Include, UI page, AI agent, or Agentic Workflow. It returns one of three results:
{#access-analysis-agent__table_results__entry__2}

| Result | What it means |
|-|-|
| **Passed** | The entity has access. The agent names the ACL (or ACLs) that grant it. |
| **Blocked** | The entity does not have access. The agent names the specific ACL, role, security attribute, or condition that's stopping it. |
| **Undefined** | No ACL evaluated the operation at all, so the platform's default behavior applies. This is different from Blocked --- there's no rule actively denying it, there's simply no rule granting it either. |
[Table 1. Access Analysis Agent results]

{#access-analysis-agent__table_results}

The agent may ask clarifying questions before it evaluates anything. It never guesses at which record you meant.

Once enabled, the Access Analysis Agent supports:

* Reading the table, record, or user you're currently viewing so you can ask an access question right from that page without naming or navigating to it
* Evaluating whether a user can access a resource
* Evaluating whether a group can access a resource
* Evaluating whether a role can access a resource
* Answering questions that cover more than one operation on the same entity and resource in one response
* Evaluating access to AI agents and Agentic Workflows themselves, not just traditional tables and fields
* Saving completed evaluations so you can find and review them again later
{#access-analysis-agent__ul_agent_capabilities}

## Prerequisites and setup {#access-analysis-agent__section_prerequisites}

Ensure the following requirements are met before using the AI agent:

* Access Analyzer is installed on your instance and active.
* The Access Analysis Agent is installed on your instance.
* AI Agent Studio is available on your instance.
* The Now Assist panel is available on your instance.
* You are signed in with a role that has access to the agent. For more information, see [Required role](https://www.servicenow.com/docs/0CH4lrIQMqc_nYKWoqUSgQ#section_required_role) below.
{#access-analysis-agent__ul_prerequisites}

## Required role {#access-analysis-agent__section_required_role}

Required role: `access_analyzer_admin` or `user_admin`.

Unlike some Now Assist agents that are open to every session role, the Access Analysis Agent is gated behind two specific roles: `access_analyzer_admin` and `user_admin` roles. These roles keep
the agent's use in line with who already has visibility into ACL structure and security configuration on your instance.

Within that gate, the agent evaluates access using the permissions your current session already holds when it looks up the underlying records. It does not escalate or borrow elevated privileges to answer your question.

## Accessing the Access Analysis Agent {#access-analysis-agent__section_accessing_agent}

To confirm the agent is installed and see its configuration:

1. Navigate to AllAI Agent StudioCreate and manage.
2. Go to the AI Agents tab.
3. Select Access Analysis Agent.

{#access-analysis-agent__ol_install_check}

To start using the agent day to day, open the Now Assist panel from the sidebar on any ServiceNow page and start a new interaction. See the procedures below for how to phrase your questions.

## Evaluate whether a user, group, or role can access a resource {#access-analysis-agent__section_evaluate_access}

Use this operation to check whether users can access a table, record, field, Client Callable Script Include, UI page, AI agent, or Agentic Workflow.

1. Ask the agent your question, naming the user, group, or role and the resource you're asking about. For example:
   * "What can user ABC access?"
   * "Can user ABC access resource X?"
   * "Does the ITIL group have write access to changes?"
   * "What can the itil role do on the incident table?"
2. If the agent can't uniquely identify the entity or resource you named, it asks a clarifying question. If your question matches more than one type of entity, the agent lists each match with its type and asks you to confirm.
3. The agent returns a Passed, Blocked, or Undefined result, along with the specific ACL, role, security attribute, or condition that determined the outcome.

{#access-analysis-agent__ol_evaluate}  
Note:  
You can ask about more than one type of access in the same question, for example both read and write access to the same resource, or a full breakdown of everything a role can do on a table.

## Learn why an operation was blocked {#access-analysis-agent__section_drill_blocked}

Use this operation when you already know an operation is blocked and want the specific reason, rather than re-asking the original question.

1. After receiving a Blocked result, ask a follow-up like "Why is user ABC blocked from report_view on incidents?"
2. The agent identifies the specific ACL, data condition, security attribute, or role gap that caused the block and explains it in plain language.
{#access-analysis-agent__ol_drill_blocked}

## Ask about access without leaving the page you're on {#access-analysis-agent__section_ask_without_leaving}

Use this operation to ask about access while viewing a record, list, or user, without typing out what you're asking about.

1. While viewing a record, list, or user page, open the ServiceNow Otto® panel. Ask your access question without naming a resource, for example: "Can user ABC access this?".
2. The agent uses the page you're viewing as the resource for the evaluation.

{#access-analysis-agent__ol_ask_without_leaving}  
Note:  
If you name a resource directly in your question, the agent uses that resource instead of the page you're viewing. Because the page you're on can change between questions, the agent runs a fresh evaluation rather than reusing an earlier answer, even if you ask what looks like the same question twice in one conversation.

## Review a past evaluation {#access-analysis-agent__section_review_past}

Use this operation to find an access evaluation you ran previously, instead of running it again.

1. Open the Now Assist panel.
2. Ask the agent to show your previous evaluations, or reference the user, group, or role from an earlier question.

{#access-analysis-agent__ol_review_past}

The agent retrieves the saved result from your earlier evaluation.

*[\>]: and then