---
sourceDocument: Brazil Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/intelligent-experiences

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Create an AI ACL

# Create an AI ACL for a Subflow or Action {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Create the necessary AI Access Control List (ACL) for the component to be called externally.

## Before you begin

Role required: admin

## About this task

AI ACLs are required for any Subflow or Action to be used as an MCP tool. An AI ACL is essential for ensuring security compatibility
of the component, regardless of data types or execution logic. This approach embraces a proactive deny-by-default model. For more information, see the [Understanding invoke_from_ai ACL in ServiceNow](https://www.servicenow.com/community/developer-articles/understanding-invoke-from-ai-acl-in-servicenow-ai-agent-flow/ta-p/3519795) article in the ServiceNow Community.

## Procedure

1. Navigate to navigation filter and enter Access Control List.
2. Select New.
3. Set the type to flow_action.
4. Set the Operation to 'Invoked from AI'.  
   This is the critical distinction. A standard record ACL will not work.
5. In the Name, paste the component's internal name (scope-qualified, e.g., global.get_flow_description).  
   You can find this by publishing the component first, then, checking the three-dot menu or the staging table.
6. Under Requires Role, add sn_mcp_server.admin (or the appropriate role for the MCP server user).
7. Submit the ACL.  
   Confirm that a record-type ACL isn't created in error, instead of an AI ACL (invoked from AI operation). If the staging table still shows security_compatible = false after publishing, verify the ACL type.