--- sourceDocument: Brazil Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Baseline version 9.0 # New hardening settings for baseline 9.0 {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read New hardening settings are available in Security Center baseline version 9.0. * [Apply static analysis to all users](https://www.servicenow.com/docs/jedD0TeMuBZf_jSIO06gLw "Configure static analysis to examine scripts from both authenticated and unauthenticated users rather than limiting analysis to guest users only.") * [Capture audit records for Code Signing-protected records](https://www.servicenow.com/docs/RyesXBeh6hRsJ_Hw5DRg7Q "Use the sn_cse.com.snc.csf.vault_audit_enabled property to control whether the system logs changes to Code Signing-protected code.") * [CSRF enforcement for session-authenticated REST APIs](https://www.servicenow.com/docs/OWp~FZg12T_emRmTcjjeOA "The glide.security.csrf.rest.public_csrf.enabled property enables Cross-Site Request Forgery (CSRF) token validation for public REST APIs that use session-cookie authentication.") * [Disable log-and-allow mode for cross-scope dot-walk access](https://www.servicenow.com/docs/RBehSop4PQeh7Ecio~unLg "The glide.script.dot_walk.log_and_allow_violations property controls logging and enforcement of access violations when dot-walk is used cross-scope.") * [Enable anti-CSRF token](https://www.servicenow.com/docs/v57CvV735tUbhs3l9j4g6A "Use the glide.security.use_csrf_token property to confirm the use of a secure token to identify and validates incoming requests, which in turn are used to prevent these attacks.") * [Enable CRL-based certificate revocation checking for outbound HTTP requests](https://www.servicenow.com/docs/VNJd4BaDsWC5TtzVNOT7Lw "Use the com.glide.communications.httpclient.disable_crl_check property to control Certificate Revocation List (CRL) revocation checking for outbound HTTP requests over Transport Layer Security (TLS).") * [Enable CSRF enforcement for authenticated processors](https://www.servicenow.com/docs/1pI8zFhGdmwTCbjHg9JfLg "Enable Cross-Site Request Forgery (CSRF) enforcement to protect authenticated processor requests from CSRF attacks when session cookies are used for authentication.") * [Enable MID Server governance checks](https://www.servicenow.com/docs/c4GXahHq1utL2GgwopzIVw "Use an inactivity timeout on your MID Servers to reduce exposure to potential attackers.") * [Enable sanitization of inbound virtual agent chat messages](https://www.servicenow.com/docs/3OyedpXUh0VHW_0rthX56Q "The glide.cs.sanitize_inbound_messages.enabled property controls whether Virtual Agent runs a dedicated HTML sanitization check on inbound chat messages sent from a requester to an agent.") * [Enable static analysis](https://www.servicenow.com/docs/EJXqHaXPe6XMKhHXylkxdQ "Enable static analysis to provide compile-time security checks for JavaScript code in the scripting sandbox.") * [Enable synchronous mode for static analysis](https://www.servicenow.com/docs/VK~gyXSlS4HmRlTqXkrFJg "The com.glide.script.static_analysis.enable_sync property controls whether static analysis security violations block script execution synchronously or are recorded asynchronously. Setting this property to true enables synchronous mode, which blocks scripts with security violations.") * [Enforce CRL certificate revocation checking for outbound HTTP requests](https://www.servicenow.com/docs/4jg2V_LCBW90na4_tSaCwA "Use the com.glide.communications.httpclient.fail_on_non_pass_crl_status property to control whether the platform terminates outbound HTTP requests when Certificate Revocation List (CRL) checks can't determine revocation status.") * [Enforce cross-scope table access when performing dot-walk](https://www.servicenow.com/docs/g3Ct7AZJHNTlwNY3Km7geA "The glide.script.dot_walk.enforce_cross_scope_access_all_tables property defines the base access control decision for all table data accessed through dot-walk when the access is cross-scope.") * [Enforce domain access control on all tables](https://www.servicenow.com/docs/Ynu~JFwd3WG7mmkcP5x_Ow "The glide.sys.domain.access_handler.included_tables property controls which tables have cross-domain write protection enforced.") * [Enforce least privilege on scoped MCP OAuth tokens](https://www.servicenow.com/docs/9qfMnnk_wxgbTumhIRXuZg "The com.snc.platform.security.oauth.mcp.aig_scope_support property controls how OAuth access tokens are cached and reused for Model Context Protocol (MCP) flows in AI Gateway (AIG).") * [Enforce signature verification for Flow Designer artifacts](https://www.servicenow.com/docs/qtd9QsTqUDrSCqX2Exvysg "The com.glide.hub.code_signing.full.validation.enabled property controls the strictness of checks enforced when Code Signing is fully enabled.") * [Enable KittyScript sandbox security enforcement](https://www.servicenow.com/docs/Rxvy9W4m__kGf6mYFmOl1w "KittyScript sandbox enforcement prevents untrusted scripts from executing with unrestricted system privileges. The following properties control enforcement activation, level, and timing. Configuring them incorrectly can cause malicious code to bypass security protections and access restricted APIs.") * [Enforce KittyScript validation for guest sessions](https://www.servicenow.com/docs/ccC0HqAt4BDJS~jwhTabDA "The com.glide.script.kittyscript.validation.mode property controls JavaScript validation for unauthenticated (guest) users before it runs in the server-side sandbox.") * [Enforce strict deny for ACLs referencing only deleted or non-existent roles](https://www.servicenow.com/docs/kz4UNZg_IiDIS8Es1QS08Q "Manage how the system handles access control lists that reference roles deleted from the system.") * [Ensure MID Server Users Have Appropriate Access Levels](https://www.servicenow.com/docs/5prn8qkjhLcwntuTw4bfvg "Verify that your MID Server user accounts does not have more the necessary granted permissions.") * [Limit basic authentication restriction allowed users](https://www.servicenow.com/docs/KEkYo1725hDMygN85w_JOA "The glide.authenticate.basic_auth.allowed_users property defines specific user accounts that bypass the Basic Authentication Restriction gate without multi-factor authentication.") * [Limit basic authentication restriction allowed roles](https://www.servicenow.com/docs/JMA_cdNjgLqURxX2Z~DEbg "The glide.authenticate.basic_auth.allowed_roles property defines roles that bypass the Basic Authentication Restriction gate without multi-factor authentication.") * [Minimize session activity timeout duration](https://www.servicenow.com/docs/~l3yHAidqwMlLdlxR5O0Cw "Use the glide.ui.session_timeout property to set the session activity timeout duration in minutes.") * [Normalise REST API access policy key generation](https://www.servicenow.com/docs/fqBF3SqdR2526_tScz~xng "The glide.rest.policy.normalize_apply_all_fields property controls how the platform builds lookup keys for REST API access policies when wildcard flags are set.") * [Prevent disabling of data separation enforcement](https://www.servicenow.com/docs/YWEwJblufc~4Napn3Faf_A "Prevent bypassing Mosaic domain-visibility filtering to maintain data separation boundaries across business units and customer domains.") * [Prevent unauthenticated roleless ACL in scripted ACLs](https://www.servicenow.com/docs/pMB1ftw1iv2lPfqsafeNow "The glide.security.allow_unauth_roleless_acl property controls whether scripted Access Control Lists (ACLs) can grant access to unauthenticated users when the ACL is otherwise roleless.") * [Restrict exposure of validation error details to end users](https://www.servicenow.com/docs/oIrzJWWxuLlKfcrvyR_tdA "Configure the platform to return generic error messages instead of detailed validation error text to end users in conversational AI interfaces when skill validation fails.") * [Restrict MID IPKI registration key retry attempts](https://www.servicenow.com/docs/pLUvbTTLaWry8HnNCa4Z0A "Configure the registration key retry threshold to prevent unauthorized Management, Instrumentation, and Discovery (MID) Server registration attempts. Setting the sn_mid_infra.registration_key.max_use_count property limits how many times a registration key can be used before it is revoked.") * [Restrict platform analytics export to authorized roles](https://www.servicenow.com/docs/aAL_orr2PCYFx7a1eH5fRw "The glide.par.export.allowed_roles property is a comma-separated list of role names permitted to export Platform Analytics dashboards and visualizations to PDF or PPT format.") * [Restrict script authorship to authorized users only](https://www.servicenow.com/docs/K7BIZlAbMWGKUZ2dx57CFw "The glide.security.scripting_governance.enabled property controls whether users must hold the script-writer role to create or modify executable script content across the platform.") * [Require JWT trust verification for guest embedded sessions](https://www.servicenow.com/docs/_SRKPRiQvg6hiMkuSFwoxQ "The glide.embedded.session.trust.verification.enabled property determines whether guest embeddable sessions require JSON Web Tokens (JWT) validation for third-party origin verification.") * [Restrict vault code signing audit exclusion to defaults](https://www.servicenow.com/docs/ZqYFDOrL~R8yil6nKCpihQ "Manage which tables are excluded from Vault Code Signing audit tracking to maintain visibility into changes on protected code artifacts.") * [Set basic authentication restriction default decision](https://www.servicenow.com/docs/lTQZ_tiopSoq8R6rWr8f1g "The glide.authenticate.basic_auth.restriction.default_decision property controls the automatic decision applied to basic-auth accounts during the Basic Authentication Restriction tracking period.") {#new-hardening-settings-for-baseline-nine__ul_baseline_nine_settings}