---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Knowledge-based authentication

# Knowledge-based authentication (security questions) {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Knowledge-based authentication (KBA) is an identification and authentication method that verifies callers by prompting them to answer preconfigured questions across conversational AI channels, such as AI voice agents. KBA can be
used to identify a caller, authenticate a caller, or both within the same interaction.

KBA validates answers against records in ServiceNow AI Platform tables. For callers whose data resides outside ServiceNow, admins can configure scripts to validate answers against external systems in real-time. External data isn't imported or stored in ServiceNow AI Platform.

## How KBA works {#knowledge-based-authentication__section_how_kba_works}

Identification locates the caller by matching their answer to a record in ServiceNow AI Platform or an external system. For example, a caller provides their business phone number, and the system finds a matching record. Identification runs once per session and establishes who the caller is before any
sensitive interaction begins.

Authentication verifies that the caller is who they claim to be. The caller answers one or more questions, and the system validates those answers against stored or externally sourced data.

KBA questions can be configured for identification, authentication, or both phases, depending on admin configuration.  
Note:  
KBA factor isn't supported for step-up authentication.

## External source validation {#knowledge-based-authentication__section_ymy_hbk_hhc}

When caller data is not stored in ServiceNow AI Platform, admins can configure a custom script on an answer record to validate the caller's response against an external system, such as a CRM or order management platform. The script receives the caller's answer as
input and returns a match result.

* For identification, the script returns the matched record.
* For authentication, the script returns a <kbd class="ph userinput">true</kbd> or <kbd class="ph userinput">false</kbd> result.

Note:  
Only <kbd class="ph userinput">snc_external</kbd> users can be authenticated using external source.

Script execution is limited to 15 seconds by default. For more information about configuration properties, see [System Properties](https://www.servicenow.com/docs/6QTa4FjduZwXO6rzeTv8Pg#create-knowledge-based-answers__system-properties).

## Context persistence {#knowledge-based-authentication__section_zcv_3bk_hhc}

Starting `"nowassist-aia-voice", version: "5.0.3"` release, answers collected during identification and authentication are persisted as session context and are available to subsequent authentication questions. Only the caller's own answers are kept, for the current session. This
means a caller does not have to repeat information they already provided. For example, if a caller provides a booking reference during identification, that value is accessible to authentication scripts without prompting the caller
again.

Only the caller's own answers are kept, for the current session.  
Note:  
Context persistence is available only for scripted answers. It doesn't capture non-scripted answer responses.

## Key strengths {#knowledge-based-authentication__section_key_strengths}

* No additional device or internet connectivity is required.
* Familiar to most users.
{#knowledge-based-authentication__ul_tkf_z1j_kjc}

## Limitations {#knowledge-based-authentication__section_limitations}

* KBA relies on information the caller knows, which can be guessed, obtained from public records, or exposed through social engineering.
* KBA isn't designed as the sole verification method for sensitive operations.
* KBA is well suited for low-risk scenarios, such as general IT support or public documentation access.

For detailed configuration instructions, see:

* [Create KBA questions](https://www.servicenow.com/docs/tKd0yhwuzxfN3Dy3IfolRw "Create knowledge-based questions to use for caller identification and authentication in AI voice agent interactions.")
* [Create KBA answers](https://www.servicenow.com/docs/6QTa4FjduZwXO6rzeTv8Pg "Create knowledge-based answers for the preconfigured security questions to confirm the user's identity.")
* [Map KBA questions to answers](https://www.servicenow.com/docs/3_an1xG4QmuUzxgWo76m3g "Map knowledge-based questions to their answers so the answers can be used to confirm a caller's identity.")
* [Specify knowledge-based questions for an AI voice agent service](https://www.servicenow.com/docs/Mn4tiXK5iBJM01_RyMpo1w "Specify the questions used for caller identification and authentication with a specific AI voice agent service.")
{#knowledge-based-authentication__ul_dcc_psy_3hc}