---
sourceDocument: Brazil Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/intelligent-experiences

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Create a file type rule

# Create a file type rule for an Arc policy {#ariaid-title1}

Release version: Brazil  
Updated October 22, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Keep sensitive file types out of reach of ServiceNow Arc by setting whether the agent can read, write, or not access files with specific extensions.

## Before you begin

Role required: sn_ai_governance.ai_steward and sn_app_arc.admin

## About this task

Arc checks file type rules before it reads or changes a file. Only the extensions you list are restricted.

## Procedure

1. Navigate to AllAI Control TowerHomeGovernPoliciesArc policies.
2. Select the policy you want to update.
3. Select the File types tab.
4. Select Create file types.  
   If the policy already has file type rules, select + Add rule instead.
5. On the form, fill in the fields.  
   {#gov-pol-arc-create-file-type-rule__table_file_type_fields__entry__2}

   | Field | Description |
   |-|-|
   | Rule Name | Name that describes what the rule does, for example, Block spreadsheets or Allow PDF documents. |
   | Priority | Order in which rules are evaluated when more than one rule covers the same extension. A lower number is evaluated first. The default is 100. Give deny rules lower numbers than allow rules, so a deny isn't overridden by a broader allow. |
   | Active | Option to enforce the rule. Selected by default. An inactive rule is left out of the policy for every policy that links it. |
   | File Extensions | Extensions the rule covers, separated by commas and without the leading dot, for example, <kbd class="ph userinput">xls,xlsx,xlsm</kbd> or <kbd class="ph userinput">pdf,docx,doc</kbd>. Enter <kbd class="ph userinput">*</kbd> to cover every extension. |
   | Access Mode | What the agent can do with matching files. Allow Read Only :   The agent can open and read the files but can't change them. Allow Read \& Write :   The agent can read, write, edit, and delete the files. Deny --- hard block all access :   The agent can't read or change the files. This is the default. |
   | Description | Compliance reason for the rule, kept for your audit trail, for example, Block spreadsheet access to prevent exposure of personal data. |
   [Table 1. New File types side panel]

   {#gov-pol-arc-create-file-type-rule__table_file_type_fields}
6. Select Create.

## Result

The rule appears on the policy's File types tab, and Arc applies it for the users the policy covers at their next policy sync.

## Example: Keep private keys and certificates out of reach {#gov-pol-arc-create-file-type-rule__example-block-key-files}

Developers sometimes keep private keys and certificate bundles in their project folders. To make sure Arc never reads or changes them, create a file type rule with the following values:

* Rule Name: <kbd class="ph userinput">Block keys and certificates</kbd>
* File Extensions: <kbd class="ph userinput">pem,key,p12,pfx</kbd>
* Access Mode: Deny --- hard block all access
* Description: <kbd class="ph userinput">Prevent agent access to private keys and certificate stores.</kbd>

Enter the extensions without the leading dot and separate them with commas. The agent can still work with every other file in the project.

*[\>]: and then