---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security
Release :
- brazil
ft:locale :
- en-US
ft:publication_title :
- Brazil Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Create KBA answers
# Create KBA answers {#ariaid-title1}
Release version: Brazil
Updated September 10, 2026
 4 minutes to read
Create knowledge-based answers for the preconfigured security questions to confirm the user's identity.{#create-knowledge-based-answers__patch-rn-zp4-1}
## Before you begin
Role required: auth_factors_admin
KBA validates answers against records in ServiceNow AI Platform tables by default. To validate against an external source such as a CRM or order management platform, select Identification or Authentication in the Script Configuration field. External data is
not imported or stored in ServiceNow AI Platform.
The User Column field determines whether an identified caller can proceed to authentication. When populated with a field that links to a system user account, the caller is eligible for authentication. When left empty or
mapped incorrectly, the caller is treated as a guest --- the caller can access personalized, non-sensitive information but can't be authenticated.
## Procedure
1. Navigate to AllAuthentication FactorsKnowledge Based FactorAnswers.
2. Select New on the Knowledge Based Answers page.
3. Specify the following fields on the form.
{#create-knowledge-based-answers__table_ucp_d5x_l3c__entry__2}
| Field | Description |
|-|-|
| Script Configuration | Type of script-based validation. Options: * None: Validate the caller's answer against a ServiceNow AI Platform table. * Identification: Validate a caller's identity via a custom script against an external system. * Authentication: Validate a caller's authentication via a custom script against an external system. Note: When Script Configuration is set to Identification or Authentication, the Answer Table, Answer Column, and User Column fields are replaced by a script editor. |
| Description | Description for the answer. For example: Business Phone Number. |
| Application | Global application scope is selected by default. |
[Table 1. Common fields]
{#create-knowledge-based-answers__table_ucp_d5x_l3c}
4. Specify fields based on the Script Configuration selected:
1. Script Configuration as None: Validate against a ServiceNow AI Platform table:
{#create-knowledge-based-answers__table_gtp_xb1_jhc__entry__2}
| Field | Description |
|-|-|
| Answer Table | Table that contains the answers. Note: The selected table should have a field referenced to the sys_user table. |
| Answer Column | Answer column from the Available list. Example: Business phone. |
| User Column | Field that links records in the Answer Table to a system user account. For example: sys_user. All fields of type reference from the Answer Table are displayed and can be selected. When populated with a valid sys_user reference, the answer supports identification and authentication. When left empty, the answer supports guest identification only and the caller can't be authenticated. Whether this field is required is controlled by the property. To learn more, see [System Properties](https://www.servicenow.com/docs/6QTa4FjduZwXO6rzeTv8Pg#create-knowledge-based-answers__system-properties). |
[Table 2. Internal source fields]
{#create-knowledge-based-answers__table_gtp_xb1_jhc} Figure 1. Knowledge Based Answer - Script Configuration: None
2. Script Configuration as Identification: Validate against an external system during identification:
{#create-knowledge-based-answers__entry__18}
| Field | Description |
|-|-|
| Script | Custom script that validates the caller's answer against an external system and returns the location of the matched ServiceNow AI Platform record. Script input: user_input , the caller's answer. Script output: * table_name: The ServiceNow AI Platform table where the matched record is located. * sys_id: The sys_id of the matched record within the specified table. If no matching record is found, leave table_name and sys_id empty. The caller isn't identified with this answer. For script execution time limits, see [System Properties](https://www.servicenow.com/docs/6QTa4FjduZwXO6rzeTv8Pg#create-knowledge-based-answers__system-properties). |
[Table 3. External source fields (Identification)]
Figure 2. Script Configuration as Identification
3. Script Configuration as Authentication: Validate against an external system during authentication:
Note:
KBA Answers - Script Configuration: Works only for users with the snc_external role.
{#create-knowledge-based-answers__entry__22}
| Field | Description |
|-|-|
| Script | Custom script that verifies the caller's answer against an external system and returns a pass or fail result. Script input: * user_id: The sys_id of the user being authenticated. * user_input: The caller's answer. * kba_session_context: a JSON object containing questions presented to the caller and the answers they provided, captured across identification and authentication steps in the current session. Only questions configured with a scripted answer are included. This enables the script to reference prior responses when validating the current answer --- for example, to cross-check answers or apply multi-field logic. Example: { "employee_id":"EMP12345", "date_of_birth":"1Jan2026" } Script output: kb_auth_result, set to true if the answer matches, false if it does not. For script execution time limits, see [System Properties](https://www.servicenow.com/docs/6QTa4FjduZwXO6rzeTv8Pg#create-knowledge-based-answers__system-properties). |
[Table 4. External source fields (Authentication)]
Figure 3. Script Configuration as Authentication
Note:
* If a question uses scripted answers, only one answer is permitted.
* If the answers are non-scripted, then multiple answers are allowed for that question.
{#create-knowledge-based-answers__ul_mxt_5ch_mjc}
However, for any given question, all associated answers must consistently follow the same approach: either all answers must support identification only, or all must support both identification and
authentication. You can't mix answer types for the same question.
5. Select Submit.
## Result
You're redirected to the Knowledge Based Answers list view. Verify if your answer is successfully added.
Figure 4. Knowledge Based Answers - list
The following properties control the behavior of knowledge-based authentication (KBA), including security question validation, answer matching, and user identification settings.{#create-knowledge-based-answers__system-properties}
{#create-knowledge-based-answers__table_zyt_2xc_m3c__entry__3}
| System properties | Description | Default Value |
|-|-|-|
| `glide.auth_factors.kba.enable_user_column` | Controls whether the User Column field is required when creating or updating an answer. Note: All answers mapped to the same question must follow the same pattern --- either all supporting identification and authentication, or all supporting identification only. | `true` |
| `glide.auth_factors.kba.script_execution_time_out` | Controls the script execution time limit in seconds for external source validation. Minimum: 1 second, Maximum: 30 seconds. | `15` |
[Table 5. System properties]
{#create-knowledge-based-answers__table_zyt_2xc_m3c}
*[\>]: and then