---
sourceDocument: Zurich IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/it-operations-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Configure roles for the Service Mapping MCP tools

# Configure roles for the Service Mapping MCP tools {#ariaid-title1}

* Release version: Zurich
* 
* Updated May 27, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Configure the role containment chain and assign the required roles to users so they can connect to the CMDB MCP Server and call the Service Mapping MCP tools.

## Before you begin

Before activating the CMDB MCP Server, confirm the following requirements are met.

* Verify that Zurich Patch 10 is installed.
* You have the MCP Platform Manager version 1.4.0 (or later) plugin activated.
* You have the CMDB MCP Server \[sn_cmdb_mcp_server\], version 1.0.0, application installed.
{#sm-mcp-config-role-hierarchy__ul_eny_vqx_mjc}

Role required: admin

## About this task

For information about the Service Mapping tools, see [Service Mapping MCP tools](https://www.servicenow.com/docs/lltlqf6noRw69VgDjKZseQ "The Service Mapping tools, delivered as part of the CMDB MCP Server, expose live application service data and enable AI clients such as Claude to query service topology, identify mapping gaps, and create new application services in natural language.").

The REST API ACL for the Service Mapping MCP tools enforces the sn_sm_gen_ai.sm_mcp_user role. This role is not automatically added to the standard Service Mapping role hierarchy after deployment. You must configure the containment
records manually, because role hierarchy assignments cannot be included in a scoped update set.

The following table describes the roles involved and the access each one grants.
{#sm-mcp-config-role-hierarchy__entry__3}

| Role | Type | Granted rights |
|-|-|-|
| service_mapping_user | Standard Service Mapping role | Read access to application service maps and topology data. Assigned to end users who query service data via the MCP Server. |
| sn_sm_gen_ai.sm_mcp_user | MCP access role | Enforced by the REST API ACL on all five Service Mapping MCP tools. Users must have this role (directly or via containment) to call the tools. |
| sn_mcp_server.viewer | MCP platform role | Grants the ability to discover and invoke tools on an MCP server. Required by sn_sm_gen_ai.sm_mcp_user. |
| sn_sm_gen_ai.sm_mcp_admin | MCP admin role | Grants elevated access for administering the Service Mapping MCP tools. |
[ ]

Figure 1. The role containment chain

## Procedure

1. Configure the role containment chain.
   1. Navigate to AllUser AdministrationRoles and open the service_mapping_user role record.
   2. In the Contains Roles related list, add sn_sm_gen_ai.sm_mcp_user.  
      The service_mapping_user role contains the sn_sm_gen_ai.sm_mcp_user role.
   3. Open the sn_sm_gen_ai.sm_mcp_user role record.
   4. In the Contains Roles related list, add sn_mcp_server.viewer.  
      Users with the sn_sm_gen_ai.sm_mcp_user role can discover and invoke tools on the Now Assist CMDB MCP Server.
   5. Open the sn_sm_gen_ai.sm_mcp_admin role record.
   6. In the Contains Roles related list, verify that sn_sm_gen_ai.sm_mcp_user is present.  
      If the role is not present, add it. This ensures that users with the admin role can also call the tools.
2. Assign the required roles to each end user who needs to query application service data through Claude Desktop.
   1. Navigate to AllUser AdministrationUsers and open the record of a user who needs access to the Service Mapping MCP tools.
   2. Scroll to the Roles related list and select Edit.
   3. Add the service_mapping_user role.  
      This role inherits sn_sm_gen_ai.sm_mcp_user and sn_mcp_server.viewer through the containment chain you configured in the previous step. All three roles are required for end-to-end tool invocation.
   4. Select Save.

## Result

The role hierarchy is configured and users are assigned the required roles. Users assigned the service_mapping_user role can connect an MCP-compatible AI client and call all five Service Mapping MCP tools. Users assigned sn_sm_gen_ai.sm_mcp_admin retain the same tool access plus elevated administrative rights.

## What to do next

[Activate the CMDB MCP Server for Service Mapping tools](https://www.servicenow.com/docs/qNdh3LH9s4lYo_9t0pyULA "Activate the CMDB MCP Server and configure the OAuth inbound integration so that external AI clients can connect to your ServiceNow instance and query application service data.")

*[\>]: and then