---
sourceDocument: Brazil Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/intelligent-experiences

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Define security controls for MCP Servers

# Define security controls for MCP Servers {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Define security controls for an MCP Servers to determine which users can access it and what permissions they have.

## Before you begin

Role required: sn_mcp_client.admin

## About this task

The security control applies only when MCP server is added to an Assistant and when a user tries to invoke the respective MCP server from that Assistant. For adding to AI Agent, this ACL won't be applied and automatically
agent ACLs are applied for the agent normally.

## Procedure

1. Open a Model Context Protocol Server and navigate to Access rules.  
   You can select which users can access this MCP server via ACLs. The access control list (ACL) is generated after you define which category of users or specific user roles can access this MCP server.
2. Select the users from the Allowed users drop down.  
   There are three possible options for ACLs created in AI Agent Studio:
   * Any authenticated user: Grants access to any user who is authenticated on the instance, regardless of the role.
   * Users with specified roles: The default ACL option that requires you to select the specific roles required to invoke an AI agent or an agentic workflow. If you select this option, you will be able to add roles in the Roles field.  
     Note:  
     As the ACLs are Allow If ACLs, any user with at least one of the roles will be able to define specific roles that the users must have to discover and interact with this AI agent.
   * Public: Grants access to all users, including guests who aren't signed in.  
     Note:  
     Understand that this configuration should be used sparingly and only when needed.
   {#define-sec-mcp__ul_qdz_hrg_njc}
3. Select Save.