---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# OOB (Out-of-Box) Security Attributes

# OOB (Out-of-Box) Security Attributes {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Commonly used, generalized security attributes roles ready for use.

## Overview {#oob-security-attributes__section_ubd_1kn_qzb}

The OOB (out-of-box) security attributes are an easy way to begin using and learning the capabilities of security attributes with a series of preconfigured security attribute roles. The OOB security attribute roles are commonly
used access control roles.

To create your own security attribute, or expand an OOB security attributes capabilities see [Compound Security Attributes](https://www.servicenow.com/docs/V4xE1hnIFoCednXSfPRu2w#compound-security-attributes "Compound security attributes enable you to create consistent and reusable security attribute profiles to suit your business needs.")
{#oob-security-attributes__table_s2b_skn_qzb__entry__2}

| Attribute | Description |
|-|-|
| Group | User is member of a specified group. |
| GroupExplicit | User is an explicit member of a specific group. |
| HasAdminRole | User has the admin persona. |
| Impersonating | User is impersonated. |
| InteractiveSession | Current session interactive. |
| LoggedIn | User is logged in and authenticated. |
| NetworkCriteria | Additional Network Criteria. |
| Role | User has specific role. |
| RoleExplicit | User has specific role explicitly defined. |
| SessionIsEmbeddedGuest | Verifies whether a transaction originates from a Web Embeddables component guest session. This attribute is set as needed through the Web Embeddables capability. For more information about how Web Embeddables are configured and used, see [Configure Web Embeddables](https://www.servicenow.com/docs/access?context=using-web-embeddables&version=brazil&pubname=brazil-customer-service-management&ft:locale=en-US). |
[Table 1. OOB Security Attributes]

{#oob-security-attributes__table_s2b_skn_qzb}

## Security attributes for client session {#oob-security-attributes__section_vvt_nfw_vbc}

Following security attributes are added for client session (plugin: <kbd class="ph userinput">com.glide.client_session_security_attributes</kbd>):

* IsIframeEmbeddedSession: The attribute is used in embedded iframe in third party portals. For example, Engagement messenger, Virtual Agent Web Client, Embedded Session, and so on.
* IsIntegrationAsAServiceSession: The attribute is used in messaging apps like Virtual Agent in teams, Virtual Agent in slack, Virtual Agent in whatapp.
* IsIntegrationAsAUserSession: The attribute is used in integration account user or web service user.
* Is Servicenow Web Session: The attribute is used in web interactive session.
* Is Mobile App Session: The attribute is used if the mobile_client property is true in the oauth_entity record.

{#oob-security-attributes__ul_zkc_bn2_5bc}  
Note:  
You must use the IsIframeEmbeddedSession, IsIntegrationAsAServiceSession, and IsIntegrationAsAUserSession only while configuring client type for OAuth and SSO records. To learn more, see [Client type configuration for OAuth and SSO records](https://www.servicenow.com/docs/9m2_pUFG4wa7aAM_xSj20w "Configure the Client Type field for OAuth and SSO record related configurations.").

## Non-explicit and explicit behavior explained {#oob-security-attributes__section_kp5_3v5_qzb}

Security Attributes address nuanced permission needs with an explicit vs. non-explicit (inherited) evaluation of roles permissions.