---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Check role access for an encrypted column with ServiceNow Otto for Vault

# Check role access for an encrypted column with ServiceNow Otto for Vault {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the check role access for encrypted column skill to identify user roles that have access to encryption and decryption keys in your instance.

## Before you begin

* Install ServiceNow Vault. For more information, see [Configuring ServiceNow Vault](https://www.servicenow.com/docs/ebEIUsP6EnMGEXsB4W7Qdw "Learn how to install and configure ServiceNow Vault.").
* Ensure that the check role access for encrypted column skill is active. For more information, see [Activate an AI skill](https://www.servicenow.com/docs/access?context=configure-a-now-assist-skill&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US).

Roles required: sn_vault_console.vault_console_admin and security_admin  
Note:  
The `security_admin` role isn't included in the `sn_vault_console.vault_console_admin` role composition and doesn't appear in the Elevate role list. A user with the admin role must assign it through the standard user-administration process. If the skill reports that you don't have the `security_admin` role, or that the role isn't active for your session, contact your admin. For more information, see [ServiceNow Vault roles](https://www.servicenow.com/docs/29JMuATlNAn~6s6~53FNbg "Learn and set up the roles necessary to use ServiceNow Vault.").

## Procedure

1. Navigate to AllVaultVault console.
2. In the ServiceNow Otto panel, select Check role access for encrypted column and specify the details.  
   Example prompt: <kbd class="ph userinput">Which roles have decryption key access to an encrypted column? Access includes read access.</kbd>

*[\>]: and then