---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Agent Access Role Configuration

# Configure role masking for an AI agent {#ariaid-title1}

Release version: Brazil  
Updated November 5, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Restrict the roles that an AI agent uses at runtime by creating an Agent Access Role Configuration record that limits the agent to a defined set of roles.

## Before you begin

Role required: <kbd class="ph userinput">sn_aia.admin</kbd>

Before you configure role masking for an AI agent, the AI agent you need to restrict must already exist.

## Procedure

1. Navigate to the sys_agent_access_configuration_list.do table.  
   The Agent Access Role Configurations page opens.
2. Select New.  
   The Agent Access Role Configuration - New Record form opens.
3. On the form, fill in the fields:  
   {#configure-role-masking__table_xxz_1jl_pjc__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name for the configuration. Example: <kbd class="ph userinput">Action Designer role mask</kbd>. |
   | Application | Scope of the application. |
   | Description | Description of the configuration. |
   | Agent Table | Table that holds the agent record you need to restrict. |
   | Action | Limit To Roles. This action restricts the AI agent to the roles you add to the configuration. The agent can't use roles outside the selected roles. |
   | Agent | The AI agent that the configuration applies to. |
   | Role List | Roles to limit using the Agent access roles list. Each role added through this lookup is stored as an individual record in the Configuration table. Note: * Previously you could use role list to add the roles. You have to use the Agent access role table to add roles. * Existing records with the `role_list` column continues to operate as expected. All new role configurations are implemented through the `sys_agent_access_role_mapping` table. {#configure-role-masking__ul_xsx_1cz_tjc} |
   | Agent access role | Role selected using the Insert a new row. Each row you add creates one record in the Agent access roles table, linking the AI agent to that role. |
   [Table 1. Agent Access Role Configuration form]

   {#configure-role-masking__table_xxz_1jl_pjc} Figure 1. Agent Access Role Configuration
4. Select Submit.
{#configure-role-masking__aia-role-masking-configure-steps}

## Result

The platform saves each role masking entry in the Agent Access Role Configurations page. The next time the AI agent runs, it uses the roles that are mapped to an agent.