--- sourceDocument: Australia Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security Release : - australia ft:locale : - en-US ft:publication_title : - Australia Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Permissions-based access control # Permissions-based access control {#ariaid-title1} * Release version: Australia * * Updated March 12, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Permissions-based access control This content explains how ServiceNow's Now Assist uses permissions-based access control to ensure AI agents operate securely and within defined boundaries. By leveraging agent role inheritance, identity types, granular roles, and role masking, ServiceNow enforces least-privilege access, so AI agents only have the permissions necessary to perform their tasks and cannot overreach their authority. These controls align AI agent permissions with standard user ACLs to maintain consistent security policies. Show full answer Show less ## Key Features * **Access Controls for AI Agents:** Mechanisms to control who can invoke AI agents and what data they can access, integrating ACLs with user identities and agentic workflows. * **Role Masking:** Allows defining an allow-list of roles that agents can inherit from invoking users during tool execution, ensuring agents operate with the minimum required privileges. * **Guided Security Setup:** Step-by-step configurations for AI agents and agentic workflows to specify user access and data access settings, enhancing precise access management. * **Access Testing:** Manual tests to verify that only authorized users can discover and invoke AI agents or agentic workflows. * **Skill Access Control:** Configuration options to manage access for custom AI skills built with the AI Skill Kit, controlling who can utilize skill-based features. * **Roles and Permissions Reference:** Documentation of Now Assist roles, including AI Admin Hub roles like *snnowassistadmin.nsaadmin* for managing skills and settings, and *snnowassistadmin.user* for read-only console access. ## Key Outcomes By implementing these access control mechanisms, ServiceNow customers can: * Ensure AI agents comply with organizational security policies by operating within explicitly defined permission boundaries. * Prevent unauthorized invocation and data access by AI agents, reducing risks related to agentic overreach. * Maintain consistent access control enforcement across AI workflows and tools, similar to standard user ACLs. * Confidently deploy AI agents and custom skills knowing that access is restricted and verifiable through testing. * Effectively manage roles and permissions related to Now Assist features through clear role definitions. Use Agent Role Inheritance, identity types, and granular roles to verify your AI agents have only the permissions they need, and can act only within their intended boundaries. ServiceNow uses AI Agents to perform tasks that range from simple automated responses to complex problem solving. AI agents are restricted by their assigner roles, and are subject to the same ACL limitations as standard users. Now Assist provides several mechanisms to enforce least-privilege access across your * Access control lists (ACLs) that determine who can invoke an agent, user identities that define what data an agent can access once invoked. * Role masking that limits inherited permissions during tool execution {#naai-permissions-based-access-control__ul_apm_shy_q3c}These controls help avoid agentic overreach and verify that AI agents operate within boundaries you define. ## Access controls for AI agents {#naai-permissions-based-access-control__section_agent_access} The following topics describe how to implement, configure, and verify access controls for Now Assist AI agents and agentic workflows. [Implement access control in AI agents](https://www.servicenow.com/docs/access?context=aia-security-implementation&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US) : Understand how ACLs and user identities work together across agentic workflows, AI agents, and tools to control who can invoke an agent and what resources it can access once invoked. [Role masking in AI agents](https://www.servicenow.com/docs/access?context=aia-role-masking&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US) : Use role masking to define an allow-list of roles that agentic workflows and AI agents can inherit from invoking users, enforcing least-privilege access during tool execution. [Define security controls for an AI agent](https://www.servicenow.com/docs/access?context=define-sec-controls-aia&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US) : Step through the AI agent guided setup to configure who can access an agent and what data it can act on, covering both user access and data access settings. [Define security controls for an agentic workflow](https://www.servicenow.com/docs/access?context=define-sec-controls-aw&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US) : Step through the agentic workflow guided setup to configure who can access a workflow and what data it can act on, covering both user access and data access settings. [Test user access to an AI agent](https://www.servicenow.com/docs/access?context=test-aia-access&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US) : Run a manual access test to confirm that only the intended users can discover and invoke a given AI agent. [Test user access to an agentic workflow](https://www.servicenow.com/docs/access?context=test-aw-access&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US) : Run a manual access test to confirm that only the intended users can discover and invoke a given agentic workflow. [Configure security controls for a skill](https://www.servicenow.com/docs/access?context=nask-access-control&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US) : Configure access control for custom skills built with the AI Skill Kit to manage who can invoke skill-based functionality. ## Roles and permissions reference {#naai-permissions-based-access-control__section_roles} The following reference topics describe the roles installed with Now Assist and what each role permits. [AI Admin Hub roles](https://www.servicenow.com/docs/access?context=roles-installed-with-now-assist-admin&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US) : A reference list of the roles installed with AI Admin Hub, including the permissions required to activate and manage Now Assist features and skills. [AI Admin Hub \[sn_nowassist_admin.nsa_admin\]](https://www.servicenow.com/docs/access?context=roles-installed-with-now-assist-admin&version=australia&pubname=australia-intelligent-experiences§ion=sn-nowassist-admin-role&ft:locale=en-US) : Details the sn_nowassist_admin.nsa_admin role, which allows users to create, edit, and configure Now Assist skills and settings. [AI Admin Hub console user \[sn_nowassist_admin.user\]](https://www.servicenow.com/docs/access?context=roles-installed-with-now-assist-admin&version=australia&pubname=australia-intelligent-experiences§ion=sn-nowassist-admin-console-user-role&ft:locale=en-US) : Details the sn_nowassist_admin.user role, which provides read-only access to the AI Admin Hub console.