---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Create a system module access policy

# Create a system module access policy {#ariaid-title1}

Release version: Brazil  
Updated April 27, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Create a module access policy (MAP) for a matched user to encrypt attachments when inbound email processing runs as that user.

## Before you begin

Role required: **security_admin** and **sn_kmf.crypto_manager** (or **sn_kmf.admin**)

## About this task

These instructions create a system-based MAP for the system user's role. See [Configure module access policies for Field Encryption](https://www.servicenow.com/docs/pPGLlh5~~jozw3gZ~0fQJA "Create a module access policy to control which users, scripts, or system processes can encrypt or decrypt data encrypted by a field encryption module.") for information.

## Procedure

1. Navigate to AllSystem SecurityField EncryptionField Encryption Experience.
2. Select Access Policies in the tile of the module configured for the target table's encryption configuration.
3. Select Create new.
4. Enter a name for your MAP in the Policy name field.
5. Select Role in the Type field.
6. In the Target role field, select the system user's role.
7. Fill out the rest of the form accordingly.  
8. Select Save.

## Result

The system MAP has been created.

*[\>]: and then