---
sourceDocument: Brazil IT Service Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-service-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil IT Service Management

ft:clusterId :

    - itsm

bundleId :

    - itsm

workflow :

    - Technology


---

# Components installed with ITSM Roles - Change Management

# Components installed with ITSM Roles - Change Management {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Components installed with ITSM Roles - Change Management

TheITSM Roles --- Change Managementplugin (com.snc.itsm.roles.changemanagement) installs several user roles designed to control access and permissions within the Change Management application in ServiceNow.
Alongside these roles, the plugin updates Security Access Control Lists (ACLs) and integrates revised scripts to enhance the security model specific to Change Management and related ITSM functionalities.
Show full answer Show less  

## Roles Installed and Their Purpose

The plugin provides a granular role-based security framework that replaces broader global admin privileges with application-specific access. Key roles and their practical uses include:

* **Change admin (snchangeadmin):** Grants configuration and authorization capabilities for system properties within Change Management, enabling administrative control without global admin rights.
* **Change read (snchangeread):** Allows full read access to all change requests and the Change Advisory Board (CAB) workbench, facilitating visibility into change processes.
* **Change write (snchangewrite):** Provides write access to Change Management records, supporting updates and modifications.
* **Incident read (snincidentread):** Permits read access to all incident records and the major incident workbench, extending visibility beyond end-user self-service capabilities.
* **Incident write (snincidentwrite):** Enables write access to incident records for managing incident lifecycle activities.
* **Problem read (snproblemread) and Problem write (snproblemwrite):** Grant read and write access to Problem Management records respectively, supporting problem investigation and resolution.
* **Request roles (snrequestread, snrequestwrite, snrequestcommentwrite):** Control access to service requests and requested items, including comment management, with specific cautions about role assignment to avoid conflicts with future updates.
* **Service Desk Agent (snservicedeskagent):** Designed for tier 1 service desk agents, allowing them to gather information and provide quick incident, problem, change, and request resolutions.

## Security Enhancements

The plugin refines the security model by updating ACLs and related scripts, improving the protection and controlled access of Change Management data and associated ITSM applications. This ensures roles have precise permissions aligned with their responsibilities.

## Additional Roles from ITSM Gen AI Plugin

Installing the **ITSM Gen AI** plugin (com.sn.itsm.gen.ai) introduces additional roles such as **knowledgeuser** and **nowassistpaneluser**, which extend capabilities related to AI-assisted ITSM functions.

## Practical Benefits for ServiceNow Customers

* Enables fine-grained access control tailored to Change Management and related ITSM processes.
* Improves security governance by replacing broad admin access with role-specific permissions.
* Supports effective segregation of duties and compliance with organizational policies.
* Facilitates efficient role assignment for various ITSM users including admins, agents, and approvers.
* Prepares the environment for enhanced AI-powered ITSM features through additional roles.  
Several user roles are installed with the activation of the ITSM Roles --- Change Management plugin (com.snc.itsm.roles.change_management). Security ACLs to support the security model for Change Management and related functionality are also installed.
When you install the ITSM Roles --- Change Management plugin (com.snc.itsm.roles.change_management), the plugin updates the Security Access Control Lists (ACLs), integrating revised scripts, and other files to overhaul the security model for these
applications.  
Note:  
The Application Files table lists the components that are installed with this application. For instructions on how to access this table, see [Find components installed with an
application](https://www.servicenow.com/docs/access?context=find-components&version=brazil&pubname=brazil-platform-administration&ft:locale=en-US).

## Roles installed {#installed-with-cm-itsm-roles__section_wly_yyh_wdb}

{#installed-with-cm-itsm-roles__table_u1t_gb1_wdb__entry__3}

| Role title \[name\] | Description | Contains roles |
|-|-|-|
| Change admin \[sn_change_admin\] | Provides configuration and authorization access for system properties in the Change Management application. Provides a granular, application-specific write access replacing the global admin role. | * sn_change_write * sn_change_cab.cab_manager * change_manager {#installed-with-cm-itsm-roles__ul_fws_b42_yhc} |
|   |   |   |
| Change read \[sn_change_read\] | Read access to the Change Management application and related records. Note: A user with the sn_change_read role can view all change requests as well as the CAB workbench. | * sn_cmdb_user * dependency_views * view_changer * cmdb_read * app_service_user * cmdb_query_builder_read {#installed-with-cm-itsm-roles__ul_dwf_455_shb} |
| Change write \[sn_change_write\] | Write access to the Change Management application and related records. | * sn_change_read * template_editor * cmdb_query_builder {#installed-with-cm-itsm-roles__ul_vvs_s2s_nhb} |
| Incident read \[sn_incident_read\] | Read access to the Incident Management application and related records. Note: An ESS user (user with no role) can view only those incidents that they create or someone else creates on their behalf. A user with the sn_incident_read role can view all incidents as well as the major incident workbench. | * dependency_views * agent_workspace_user * view_changer * cmdb_read * cmdb_query_builder_read {#installed-with-cm-itsm-roles__ul_o2j_rh1_zsb} |
| Incident write \[sn_incident_write\] | Write access to the Incident Management application and related records. | * sn_incident_read * template_editor {#installed-with-cm-itsm-roles__ul_y5r_l1f_v1c} |
| Problem read \[sn_problem_read\] | Read access to the Problem Management application and related records. | NA |
| Problem write \[sn_problem_write\] | Write access to the Problem Management application and related records. | * sn_problem_read * template_editor |
| sn_request_read | Read access to the Request (sc_request) or Requested Item (sc_req_item) only for a user who is also an approver of the request or requested item. Note: As there are future updates expected for the sn_request_read role, do not assign it to users without the business_stakeholder role. | NA |
| sn_request_write | Write access to the Request (sc_request) or Requested Item (sc_req_item). | * task_editor * dependency_views * agent_workspace_user * view_changer * cmdb_read * cmdb_query_builder_read * sn_request_read |
| sn_request_comment_write | Write access to the comments for the Requested Item (sc_req_item). Note: The sn_request_comment_write role alone does not give access to comments write, you will need write access for the table. | NA |
| \[sn_service_desk_agent\] | Enables gathering, and verifying information, as well as delivering quick resolutions for tier 1 service desk agents. This user role is available when the ITSM Roles plugin (com.snc.itsm.roles) is installed. | * sn_incident_write * sn_problem_write * sn_change_write * sn_request_write * tracked_file_reader {#installed-with-cm-itsm-roles__ul_utk_nwr_ydc} With the installation of the ITSM Gen AI (com.sn.itsm.gen.ai) plugin, the following roles are also available: * knowledge_user * now_assist_panel_user {#installed-with-cm-itsm-roles__ul_ymk_fxr_ydc} |
[ ]

{#installed-with-cm-itsm-roles__table_u1t_gb1_wdb}