---
sourceDocument: Brazil IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Configure roles for the Service Mapping MCP tools

# Configure roles for the Service Mapping MCP tools {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Assign the required roles to users so they can connect to the CMDB MCP Server and call the Service Mapping MCP tools.

## Before you begin

Before assigning roles, confirm the following requirements are met.

* You have the latest version of MCP Platform Manager plugin activated.
* You have the CMDB MCP Server \[sn_cmdb_mcp_server\], version 1.1.1, application installed.
{#sm-mcp-config-role-hierarchy__ul_eny_vqx_mjc}

Role required: admin

## About this task

For information about the Service Mapping tools, see [Service Mapping MCP tools](https://www.servicenow.com/docs/J8y5aCWYhe3yBPI4mlT87w "The Service Mapping tools expose live application service data and enable AI clients to query service topology, identify mapping gaps, and create application services in natural language.").

The sn_sm_gen_ai.sm_mcp_user role grants access to all six Service Mapping MCP tools, including the create_top_down_application_service write tool.

sn_sm_gen_ai.sm_mcp_user automatically includes service_mapping_user and the MCP platform role sn_mcp_server.viewer. No manual role containment configuration is needed.  
Note:  
If you configured role containment manually in a previous release, no action is needed. The shipped containment does not conflict with existing records.

The following table describes the roles involved and the access each one grants.
{#sm-mcp-config-role-hierarchy__entry__3}

| Role | Type | Granted rights |
|-|-|-|
| sn_sm_gen_ai.sm_mcp_admin | MCP admin role | Contains sn_sm_gen_ai.sm_mcp_user and service_mapping_admin. Grants no access to the Service Mapping MCP tools beyond what sn_sm_gen_ai.sm_mcp_user already grants; service_mapping_admin covers general Service Mapping administration, unrelated to the MCP tools. |
| sn_sm_gen_ai.sm_mcp_user | MCP access role | Access to all six Service Mapping MCP tools, including create_top_down_application_service, enforced by the REST endpoint ACL. Contains service_mapping_user and sn_mcp_server.viewer. |
| service_mapping_admin | Standard Service Mapping role | Administrative access to Service Mapping configuration. Included automatically under sn_sm_gen_ai.sm_mcp_admin. |
| service_mapping_user | Standard Service Mapping role | Read access to application service maps and topology data. Included automatically under sn_sm_gen_ai.sm_mcp_user. |
| sn_mcp_server.viewer | MCP platform role | Grants the ability to discover and invoke tools on an MCP server. Included automatically under sn_sm_gen_ai.sm_mcp_user. |
[ ]

Note:  
Role checks for Service Mapping tools and CMDB tools are independent, even though both tool groups run under the same MCP server. A user with only a Service Mapping role gets an authorization error on every CMDB tool, and a user with only a CMDB role gets an authorization error on every Service Mapping tool.
Figure 1. The role containment hierarchy

## Procedure

1. Navigate to AllUser AdministrationUsers and open the record of a user who needs access to the Service Mapping MCP tools.
2. Scroll to the Roles related list and select Edit.
3. Add the sn_sm_gen_ai.sm_mcp_user role.  
   This role grants access to all six Service Mapping MCP tools, including create_top_down_application_service. It automatically includes service_mapping_user and the MCP platform role sn_mcp_server.viewer; no additional roles need to be assigned.
4. Select Save.

## Result

The user is assigned the sn_sm_gen_ai.sm_mcp_user role and can call all six Service Mapping MCP tools, including create_top_down_application_service. The role automatically includes service_mapping_user and the MCP platform role sn_mcp_server.viewer.

## What to do next

[Activate the CMDB MCP Server for Service Mapping tools](https://www.servicenow.com/docs/Dj4lFCnByhU1fP_Yz7tZuw "Activate the CMDB MCP Server and configure the OAuth inbound integration so that external AI clients can connect to your ServiceNow instance and query application service data.")

*[\>]: and then