---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Disable adding default roles to skill ACLs

# Disable adding default roles to skill ACLs {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use system properties to control what roles are automatically added to generative AI skill ACLs.
Use the com.glide.one_extend.include_default_roles_for_skill_acl system property to control whether roles are automatically added to generative AI skill ACLs when they're created or updated using the
global.GenAiSkillSecurityUtils API. This property is used to enforce consistent security policies across all AI skills.

When a skill ACL is inserted or updated, the default roles defined in the com.glide.one_extend.default_roles_for_skill_acl system property are automatically included. This addition ensures that certain privileged roles always have access to execute the skills. The com.glide.one_extend.default_roles_for_skill_acl property may contain a comma-separated list of roles.

Roles are automatically added to Generative AI Skill ACLs when com.glide.one_extend.include_default_roles_for_skill_acl is set to true. Depending on the role, this may allow overly broad access to certain skills and override intended ACL behavior.

1. Navigate to /sys_properties_list.do on the instance.
2. Ensure the com.glide.one_extend.include_default_roles_for_skill_acl property does not exist in the sys_properties table or is set to <kbd class="ph userinput">false</kbd>.

## More information {#sc-disable-adding-default-roles-to-skill-acls__section_wm4_vkk_xhc}

{#sc-disable-adding-default-roles-to-skill-acls__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | com.glide.one_extend.include_default_roles_for_skill_acl |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | false |
| Default value | false |
| Fallback value | false |
| Category | [Access control](https://www.servicenow.com/docs/x7vcJqvJ0dwOasc9M2~48A "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Security risk | * Severity score: 4.2 * CVSS score: Medium * Security risk details: Roles are automatically added to Generative AI Skill ACLs when com.glide.one_extend.include_default_roles_for_skill_acl is set to true. Depending on the role, this may allow overly broad access to certain skills and override intended ACL behavior. {#sc-disable-adding-default-roles-to-skill-acls__ul_g1g_3sf_xwb} |
| Functional impact | When com.glide.one_extend.include_default_roles_for_skill_acl is set to <kbd class="ph userinput">false</kbd>, roles are no longer automatically granted access to generative AI skill ACLs --- any role that needs to execute a skill must satisfy the skill's own access control instead of relying on an automatically-added default role. The related com.glide.one_extend.default_roles_for_skill_acl property, which lists which roles get auto-added when com.glide.one_extend.include_default_roles_for_skill_acl is set to true, has no effect while it is set to false. |
| Dependencies and prerequisites | None |
[ ]

{#sc-disable-adding-default-roles-to-skill-acls__table_ajc_b43_3kb}