--- sourceDocument: Brazil Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Step-up authentication # Step-up authentication {#ariaid-title1} Release version: Brazil Updated October 19, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Step-up Authentication Step-up authentication enhances security for AI voice agents handling sensitive requests by requiring an additional verification challenge after the caller is initially authenticated. This approach allows callers to access general services with lighter verification and only complete stronger authentication when needed, such as for password resets or accessing bank details. Show full answer Show less ## How Step-up Authentication Works * **Trigger:** Activated when a caller reaches an AI voice agent that handles sensitive requests requiring step-up authentication. * **Precondition:** Caller must already be authenticated before the step-up challenge runs. * **Attempts:** Only one attempt is allowed; failure blocks the request and redirects the caller to a fallback method configured in AI Voice Assistant Designer. * **Factor Reuse:** The same authentication factor (e.g., SMS OTP) can be reused for step-up but requires a new challenge and code. * **Scope and Duration:** One step-up factor applies per voice assistant and is shared across all AI voice agents requiring step-up within that assistant. The elevated authentication state lasts for the call duration. * **Configuration:** * AI voice agents that require step-up authentication are configured in the Access rules section of AI Agent Studio. * The step-up authentication factor is selected on the Caller verification screen in AI Voice Assistant Designer. ## Supported Authentication Factors * Okta Verify push notification * SMS verification code * Authenticator app time-based One Time Password (TOTP) **Note:** Knowledge-based authentication (KBA), Soft PIN, and Email OTP are not supported for step-up authentication. ## Combining Step-up Authentication with Other Factors Step-up authentication is an additional security layer running after the initial authentication factors configured for the voice assistant. It can reuse factors used earlier in the call but issues a new challenge for each step-up attempt. Unsupported factors for step-up can still be used as initial authentication factors. **Examples:** * Using different factors at each step (e.g., Soft PIN, then SMS code, then Okta Verify push notification for step-up) * Reusing the same factor for step-up (e.g., SMS verification code both initially and for step-up, with a new code sent) ## Limitations * Step-up applies at the AI voice agent level, not individual actions within an agent. * Only one step-up factor is configured per voice assistant and shared across all AI voice agents requiring it. * Only one attempt is allowed for step-up authentication. * The elevated authentication state remains active for the entire call and does not expire early. * The elevated state is not transferred across different voice assistants or to live agents during call handoff. ## Availability and Requirements * The system property **glide.convaivoice.stepup.enabled** must be set to true. * The chosen step-up authentication factor must be configured at the platform level. * The AI voice agent must be configured to require step-up authentication in AI Agent Studio. * A step-up factor must be selected on the Caller verification screen in AI Voice Assistant Designer (requires *authfactorsadmin* role). ## Practical Benefits for ServiceNow Customers Implementing step-up authentication allows customers to enforce stronger security only when necessary, improving user experience during routine calls while protecting sensitive transactions. It enables flexible configuration per AI voice agent and supports multiple secure authentication methods, enhancing overall trust and compliance in voice interactions. Step-up authentication requires a caller who is already authenticated to complete an additional challenge before reaching an AI voice agent that handles a sensitive request. ## When to use step-up authentication {#step-up-authentication__when-to-use} Without step-up authentication, every caller is verified once at the start of the call and keeps the same level of access for the rest of it. The verification required at the start therefore has to be strong enough for the most sensitive request the caller might make later. Step-up authentication separates the two. Callers complete a lighter verification to reach general requests, and complete an additional challenge only when the call reaches an AI voice agent that handles a sensitive request, such as a password reset or access to bank account details. ## How step-up authentication works {#step-up-authentication__how-it-works} A caller must already be authenticated before step-up authentication can run. If the caller's first request reaches an AI voice agent that requires step-up authentication, the caller must first complete configured identification and authentication. The step-up challenge runs only after that authentication is complete. Step-up authentication behaves as follows: {#step-up-authentication__how-it-works__entry__2} | Behavior | Detail | |-|-| | Trigger | On entry to an AI voice agent that requires step-up authentication. It applies to all the actions the agent performs. | | Attempts | One attempt. If the caller doesn't complete the challenge, the request is blocked. The caller is then directed to the fallback method configured on the Safeguards screen in AI Voice Assistant Designer. | | Factor reuse | The first or second authentication factor can be selected again for step-up. A new challenge is issued. For example, if SMS OTP is the configured authentication factor and the step-up factor, the caller receives a new code during step up attempt. The earlier code is not reused. | | Scope | One step-up factor per voice assistant, shared by every AI voice agent in that assistant that requires step-up authentication. | | Duration | Applies for the rest of the call. | | System property | `glide.conv_ai_voice.step_up.enabled`, by default set to true. | [ ] ## Configuration {#step-up-authentication__configuration} Step-up authentication requires two settings, configured on different screens. * Which AI agents require step-up authentication is set in the Access rules section of AI Agent Studio. Step-up authentication is set per agent, in the Access rules section of AI Agent Studio, where agents are configured and built. For more information, see [AI Agent Studio](https://www.servicenow.com/docs/access?context=aias-landing&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US). * Which factor callers use for step-up authentication is set on the Caller verification screen in AI Voice Assistant Designer. For more information, see [Configure step-up authentication](https://www.servicenow.com/docs/TDBIfn8PeVCPgsvtBRPiuA "Configure step-up authentication to require an additional challenge before callers reach AI voice agents that handle sensitive requests."). {#step-up-authentication__ul_k4k_cys_5kc} If an AI voice agent requires step-up authentication and no step-up factor is selected for the voice assistant, callers reaching that agent are directed to the configured fallback method. ## Supported factors {#step-up-authentication__supported-factors} * Okta Verify push notification * SMS verification code * Authenticator app time-based One Time Password (TOTP) {#step-up-authentication__ul_xtn_qvs_5kc} Note: Knowledge-based authentication (KBA), Soft PIN, and Email one-time password (OTP) aren't supported for step-up authentication. ## Combining step-up authentication with other factors {#step-up-authentication__combining-with-factors} Step-up authentication is an additional layer on top of the factors configured for the voice assistant. It doesn't replace the configured authentication factor. It runs after them, and only when the call reaches an AI voice agent that requires it. The step-up factor is selected separately from the first factor and second factor: * A factor used as the first factor or second factor can also be selected as the step-up factor. The caller receives a new challenge each time. * A factor that isn't supported for step-up authentication isn't excluded from the earlier steps. Soft PIN, for example, can be the first authentication factor even though it isn't supported as the step-up factor. {#step-up-authentication__ul_u25_5xt_5kc} The following examples show how the three can be combined. {#step-up-authentication__table_v25_5xt_5kc__entry__5} | Example | First factor | Second factor | Step-up factor | What the caller experiences | |-|-|-|-|-| | A different factor at each step | Soft PIN | SMS verification code | Okta Verify push notification | The caller completes the step-up challenge with an Okta Verify push notification after reaching an AI voice agent that requires it. | | The same factor reused for step-up authentication | SMS verification code | Okta Verify push notification | SMS verification code | The caller receives a new verification code rather than reusing the code sent earlier in the call. | [ ] {#step-up-authentication__table_v25_5xt_5kc} ## Limitations {#step-up-authentication__limitations} * Step-up authentication applies at the AI voice agent level. It can't be applied to individual actions within an agent. * One step-up factor is configured per voice assistant. Every AI voice agent in that assistant that requires step-up authentication uses the same factor. * Step-up authentication is one attempt. The retry setting in Advanced options applies to first factor and second factor authentication only. * The elevated state applies for the duration of the call and can't be configured to expire earlier. * The elevated state isn't carried across voice assistants and isn't transferred when the call is handed off to a live agent. {#step-up-authentication__ul_ytn_qvs_5kc} ## Availability {#step-up-authentication__availability} Step-up authentication is available for AI voice agents when the following conditions are met: * The `glide.conv_ai_voice.step_up.enabled` system property is set to `true`. * The factor you want to use for step-up authentication is configured at the platform level. For more information, see [Authentication factors](https://www.servicenow.com/docs/kVN5msZ5XeNd8b6MW5_Xpw "Authentication factors are the elements used for caller identification and authentication. In secure voice agent environments, the process begins with identifying the caller, followed by authenticating their identity before granting access. A robust security strategy combines multiple factors to confirm that only authorized users interact with AI voice agents."). * The AI voice agent is set to require step-up authentication in the Access rules section of AI Agent Studio. * A step-up factor is selected for the voice assistant on the Caller verification screen in AI Voice Assistant Designer. To make this selection, you need the `auth_factors_admin` role. {#step-up-authentication__ul_szl_myt_5kc} **Related concepts** * [Authentication factors](https://www.servicenow.com/docs/kVN5msZ5XeNd8b6MW5_Xpw "Authentication factors are the elements used for caller identification and authentication. In secure voice agent environments, the process begins with identifying the caller, followed by authenticating their identity before granting access. A robust security strategy combines multiple factors to confirm that only authorized users interact with AI voice agents.") **Related tasks** * [Configure step-up authentication](https://www.servicenow.com/docs/TDBIfn8PeVCPgsvtBRPiuA "Configure step-up authentication to require an additional challenge before callers reach AI voice agents that handle sensitive requests.") **Related topics** * [Identify and authenticate the caller](https://www.servicenow.com/docs/access?context=configure-voice-assistants&version=brazil&pubname=brazil-conversational-interfaces&ft:locale=en-US)