---
sourceDocument: Brazil Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/intelligent-experiences

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Create a client access policy

# Create a client access policy {#ariaid-title1}

Release version: Brazil  
Updated October 26, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Grant one client access to specific tools on an MCP server.

## Before you begin

* Client access control must be turned on for the instance. For details, see [Turn on client access control for your instance](https://www.servicenow.com/docs/Hqnk3nUKzRsp6iPQpOgsbQ "Set a system property so that AI stewards can turn on access management and create client access policies for MCP servers.").
* The client must be registered for the MCP server, or be a Client ID Metadata Document (CIMD) client. For details, see [Connecting agents through AI Gateway](https://www.servicenow.com/docs/9_0XuwsnFx54Zjo0jce2JQ "Register the clients that can connect to an approved MCP server, and then configure agents to call the server through its AI Gateway MCP server URL.").

{#ai-gw-create-client-access-policy__ul_ai-gw-create-client-access-policy-prereqs}

Role required: sn_ai_governance.ai_steward

## About this task

A policy grants access to one client. To grant several clients access, create a policy for each client. A client is authorized to use every tool that any of its policies grants, whether it has one policy or several.

## Procedure

1. In AI Control Tower, navigate to InventoryAssetsMCP servers and select the server name.
2. Select the AI Gateway tab, and then select the Policies sub-tab.
3. Under Policy categories, select Access management.
4. In the Client access section, select Create client access policy.  
   The Server scope field shows the current MCP server. A client access policy applies only to the server that it's created on.
5. In the Policy name field, enter a name for the policy.  
   The name must be unique on this MCP server, regardless of case, and can be up to 100 characters. It can't contain HTML tags.
6. **Optional:** In the Description field, enter a description of up to 255 characters.
7. In the Client list, select the client that receives access.  
   The list shows the clients registered for this server and the CIMD clients on the instance. If the list shows No clients available for this server, register a client first.
8. In the Tools field, search for and select each tool that the client can use, or select Add all tools.  
   The selected tools appear below the field. To remove a tool, select the close icon on its label.

   Add all tools adds the tools that are on the server when you select it. Tools that the server exposes later aren't added to the policy.

   Inactive tools appear with (Inactive) after their names. You can add them, but AI Gateway is set up to block calls to them until they're activated.
9. Select Save and close.  
   Save and close is available after you enter a policy name, select a client, and add at least one tool.

## Result

The policy appears in the Client access list, and the count next to Access management increases.  
Important:  
If access management is on for the server, it can take up to 30 minutes for the policy to apply to clients that are already connected. For details, see [Controlling which tools clients can access](https://www.servicenow.com/docs/vdbnwpXstkbsfKFUA2BcLQ "Limit each client to the MCP server tools that it requires by turning on access management for the server and creating client access policies.").

## What to do next

If access management is off for the server, the policy isn't enforced until you turn it on. For details, see [Turn access management on or off for an MCP server](https://www.servicenow.com/docs/EfIcaTxNIHRzz5vjec6~Yg "Turn on access management to limit each client to the tools that its policies grant, or turn it off to let every client use all active tools.").

*[\>]: and then