Configure role masking for an AI agent

  • Release version: Australia
  • Updated July 15, 2026
  • 1 minute to read
  • Restrict the roles that an AI agent uses at runtime by creating an Agent Access Role Configuration record that limits the agent to a defined set of roles.

    Before you begin

    Role required: sn_aia.admin

    Before you configure role masking for an AI agent, verify the AI agent you want to restrict already exists.

    Procedure

    1. Navigate to the sys_agent_access_configuration_list.do table.

      The Agent Access Role Configurations page opens.

    2. Select New.
      The Agent Access Role Configuration - New Record form opens.
    3. On the form, fill the fields:
      Table 1. Agent Access Role Configuration - Form
      Field Description
      Name Specify a name that for the configuration. Example: Action Designer role mask.
      Application Scope of the application.
      Description Specify a description for the configuration.
      Agent Table Select the table that holds the agent record you want to restrict.
      Action Select Limit To Roles. This action restricts the AI agent to the roles you add to the configuration. The agent can't use roles outside the selected roles.
      Agent Look up and select the specific AI agent the configuration applies to.
      Role List Add the roles to limit using the Agent access roles list. Each role added through this lookup is stored as an individual record in the Configuration table.
      Note:
      • Previously you could use role list to add the roles. Now, you have to use the Agent access role table to add roles.
      • Existing records with the role_list column continues to operate as expected. All new role configurations is implement through the sys_agent_access_role_mapping table.
      Agent access role Select the role using the Insert a new row... Each row you add creates one record in the Agent access roles table, linking the AI agent to that role.
      Figure 1. Agent Access Role Configuration
      Agent Access Role Configuration
    4. Select Submit.

    Result

    The platform saves the each role masking entry in the Agent Access Role Configurations page. The next time the AI agent runs, it uses the roles that are mapped to an agent.