--- sourceDocument: Zurich Enable AI sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/intelligent-experiences Release : - zurich ft:locale : - en-US ft:publication_title : - Zurich Enable AI ft:clusterId : - platai bundleId : - platai workflow : - Platform --- # Security for AI agents # Implement access control in AI agents {#ariaid-title1} Release version: Zurich Updated September 11, 2025 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Implement Access Control in AI Agents The implementation of access control for AI agents on the ServiceNow AI Platform is crucial for ensuring security within agentic workflows. It involves defining which users can access AI resources and the level of access they have. This is managed through access control lists (ACLs), user identities, and role masking. Show full answer Show less ## Key Features * **Access Control Lists (ACLs):** ACLs specify the roles required for users to invoke AI agents or workflows. Each agentic workflow and AI agent requires its own ACL configuration. * **User Identity:** The user identity determines the operational identity of the AI agent or workflow during execution, influencing access to data and actions based on the assigned roles. Two configurations are available: * **Dynamic User:** The identity of the invoking user, which changes roles based on who initiates the execution. * **AI User:** A fixed identity with consistent roles, useful for actions requiring elevated privileges. * **Role Masking:** Limits roles available to an AI agent during execution, applicable only when running as a dynamic user. * **Supervised Execution Mode:** Enhances security by requiring human approval for actions performed by AI agents, particularly for sensitive operations. ## Key Outcomes By effectively implementing access control, ServiceNow customers can ensure that AI agents operate securely and within defined parameters. This leads to minimized risks associated with unauthorized access and enhances the overall integrity of workflows. Configuring ACLs, user identities, and role masking allows organizations to tailor permissions based on their specific security needs, ensuring that sensitive actions are properly vetted through supervised execution when necessary. Implement security controls for AI agents and agentic workflows through access control lists (ACLs), user identities, and role masking to implement the access control-based security measures in the agentic system. ## Security for AI agents overview Access controls for agentic AI on the ServiceNow AI Platform comprises the major aspects: determining which users can access agentic AI resources, and what access each of those resources has once invoked. These aspects are controlled through three main components: access control lists (ACLs), user identities and role masking. The interaction between these components at the agentic workflow, AI agent, and tool levels within the AI Agent Studio influences their overall security and functionality. ## Access control lists {#aia-security-implementation__section_v1z_hhb_hgc} The access control lists (ACLs) in AI agents determine which role(s) a user must have to be allowed to invoke an agentic workflow or an AI agent. ACLs must be configured individually for each agentic workflow, AI agent, and certain AI agent tools. The ACLs added to an AI agent and agentic workflow are available in the respective related lists for reference. Important: ACLs configured in AI Agent Studio only determine the roles required for users to invoke an agentic workflow or an AI agent. They don't determine the access that the agentic workflow or an AI agent has once it's invoked. ## User identity {#aia-security-implementation__section_rch_xgg_hgc} The user identity determines which user the AI agent or an agentic workflow operates as during execution, and therefore the data it can access and the actions it can take, depending on the roles assigned to the user identity. After configuring the access control lists (ACLs), you must configure the User identity (also called as Run as) which the AI agent or agentic workflow will run as during execution. Note: Each agentic workflow and AI agent has its own user identity configuration. There are two possible user configurations to select from: * Dynamic user: The user identity of the person or resource (automated trigger/agentic workflow/parent agent) invokes the execution of an AI agent or an agentic workflow. The roles assigned to the agentic workflow or AI agent will change dynamically depending on the identity of the invoking user. Note: Dynamic user is the default user identity, and you can use the dynamic user unless there's a specific need that justifies an AI user. * AI user: A dedicated user identity that the AI agent or an agentic workflow runs as during execution, which has assigned roles that remain consistent regardless of who or how the execution is invoked. For example, an AI agent or an agentic workflow may need to be run with elevated privileges that the dynamic user might not have. If configured as a dynamic user, the execution would fail. However, if the AI agent or agentic workflow is configured to run as an AI user that has the elevated roles assigned to it, the execution will succeed even when invoked by a user with lower privileges. {#aia-security-implementation__ul_xkr_mhg_hgc} If you don't have a suitable AI user but want to use the AI user identity, you must create a record on the User \[sys_user\] table. See [Create a user](https://www.servicenow.com/docs/access?context=t_CreateAUser&version=zurich&pubname=zurich-platform-administration&ft:locale=en-US) and select AI user as the identity type. Note: * Role masking limits which roles an AI agent can use during execution. It only applies when the agent runs as a dynamic user --- not when it runs as an AI user. The key difference: AI users determine the identity the agent runs as and role masking narrows the roles available to an agent that run as a dynamic user. * For more information about user identity in an AI agent, refer to [Define security controls for an AI agent](https://www.servicenow.com/docs/dXvvVFPByrXRUHxE_roitw "In the guided setup for an AI agent, define security controls for who can access the AI agent and what data the AI agent has access to."). * For more information about user identity in an agentic workflow, refer to [Define security controls for an agentic workflow](https://www.servicenow.com/docs/J8tIMMU4bpuaMo8GLEwcFQ "In the guided setup for an agentic workflow, define security controls for who can access the agentic workflow and what data the agentic workflow has access to."). {#aia-security-implementation__ul_uyp_ncn_xgc} * For each component's execution, the ACL is checked against the invoking user identity, and if passed, the component's run as user identity is applied. Any downstream components' ACLs are checked in comparison to the run as user identity of component directly before it in the agentic hierarchy, and their run as user identities are passed down to the next downstream component's ACLs. Note: * The generative AI Skills and other tools of AI agents always run as Dynamic Users. * This flow applies to user-invoked agents. Agents with automated triggers operate without a conversational user; role masking still applies, but the invoking context is a system session rather than an individual user. {#aia-security-implementation__ul_cjg_3r2_njc} {#aia-security-implementation__ul_ctr_vtg_xgc} ## Supervised execution mode for AI agents {#aia-security-implementation__section_ugm_tbp_chc} Configuring AI agents' tools to run in supervised mode is another way to minimize the potential negative impact of an AI agent that is not executing as expected. This will require human approval for the tool's actions before it executes. You can use the Supervised mode to enhance security for agents with the capability to perform sensitive or critical actions. You can set the supervised execution mode when creating a tool in the AI agent guided setup. For example, choose Supervised as the Execution mode when adding a catalog item tool. For reference, see [Add a catalog item to an AI agent](https://www.servicenow.com/docs/~10ujvHWnToY3ot886CG2Q "Add a Service Catalog to an AI agent in AI Agent Studio so that your users can access conversational catalog items.").