---
sourceDocument: Zurich ServiceNow AI Platform Capabilities
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/servicenow-platform

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich ServiceNow AI Platform Capabilities

ft:clusterId :

    - platcap

bundleId :

    - platcap

workflow :

    - Platform


---

# Managing access to knowledge bases and knowledge articles

# Managing access to knowledge bases and knowledge articles {#ariaid-title1}

* Release version: Zurich
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 7 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Managing access to knowledge bases and knowledge articles

This guide explains how ServiceNow customers can manage user access to knowledge bases and knowledge articles by controlling who can read or contribute content.
Access is controlled primarily through user criteria (recommended from Knowledge Management v3 onwards) and roles.
Knowledge administrators, knowledge base managers, and owners can assign these criteria and roles to regulate read and contribute permissions at both the knowledge base and article levels.
Show full answer Show less  

## Controlling Access with User Criteria and Roles

**Read access** allows users to view knowledge articles, while **contribute access** permits users to create, modify, or retire articles. User criteria are categorized as:

* **Cannot Contribute/Can Contribute:** Define contribute permissions at the knowledge base level.
* **Cannot Read/Can Read:** Define read permissions at both knowledge base and article levels.

If no user criteria are set for a knowledge base, all users may read, and users with roles may contribute by default.

## Special User Privileges

Users with special roles bypass user criteria restrictions:

* **Knowledge administrators:** Full contribute and read access to all knowledge bases (except scoped bases) and can assign user criteria.
* **Knowledge base owners and managers:** Full contribute and read access to their knowledge bases and can manage user criteria. Note that managers cannot modify draft articles by other authors if article versioning is enabled.
* **Ownership group members:** Can read, modify, approve, and retire specific knowledge articles.

## Explicit Roles and Plugin Integration

The Explicit Roles plugin adds predefined user criteria based on internal roles (e.g., `sncinternal`) to control access automatically for knowledge bases. When upgrading to versions with this plugin, existing knowledge bases require a fix script to apply these criteria properly.

## System Properties Influencing Access

Several system properties affect how user criteria determine access:

* **`glide.knowman.blockaccesswithnousercriteria`:** Controls contribute and read access when no user criteria are set. If true, no access except for special users; if false, users with roles or unauthenticated users can access accordingly.
* **`glide.knowman.applyarticlereadcriteria`:** Determines whether article-level read criteria override knowledge base contribute access.
* **`glide.knowman.search.applyrolebasedsecurity` (requires manual addition):** Allows overriding role-based security for articles using user criteria only.

## Using Diagnostics and Best Practices

After setting user criteria, administrators can use the User Criteria Diagnostics feature to verify effective access for users to knowledge bases and articles. It is recommended to use user criteria rather than roles to control article-level access for better granularity and compliance with newer versions.

## Practical Actions for ServiceNow Customers

* Create and assign user criteria at the knowledge base level to define who can read or contribute content.
* Use user criteria at the article level to refine read access permissions for specific articles.
* Understand default behaviors when no user criteria are set and adjust system properties if needed to enforce stricter access controls.
* Leverage special user roles for administrative and managerial access without restricting their workflow.
* Utilize diagnostic tools to confirm that access settings meet organizational policies.
* Apply fix scripts when activating the Explicit Roles plugin on existing knowledge bases to ensure proper access assignments.  
Determine whether certain users or categories of users can access knowledge bases and
knowledge articles by controlling contribute and read access.  
As a knowledge administrator, manager of a knowledge base, or owner of a knowledge base, you can assign user criteria to control contribute and read access at the knowledge base level, where:

* Read access determines the ability to view knowledge articles in a knowledge base.
* Contribute access determines the ability to create, modify, and retire knowledge articles in a knowledge base.
{#user-access-knowledge__ul_xrd_nbq_qjb}

As a knowledge administrator, manager of a knowledge base, or owner of a knowledge base, you
can assign user criteria, or roles, or both, to control read access at the knowledge article
level.

Try to use only user criteria, which were introduced in Knowledge Management v3, to
control access to knowledge articles. Roles were used for this purpose in Knowledge Management v2. If no user criteria is selected for a knowledge base, all
users can read and all users with roles can contribute to that knowledge base.  
Note:  
By default, when contribute access isn't provided for a knowledge base, a user must meet both roles and user criteria conditions for read access. However, you can override roles set for a knowledge article and provide access through user criteria only by setting the glide.knowman.search.apply_role_based_security system property to <kbd class="ph userinput">false</kbd>. Because this property isn't available by default, you must add it. For more information, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=zurich&pubname=zurich-platform-administration&ft:locale=en-US).

## User criteria for knowledge access {#user-access-knowledge__section_i52_wtf_sjb}

As a knowledge administrator, manager of a knowledge base, or owner of a knowledge base,
you control access to knowledge bases or knowledge articles for a user through user
criteria, which are described in the following table.
{#user-access-knowledge__table_m2t_r55_2jb__entry__2}

| User criteria | Result |
|-|-|
| Cannot Contribute | Cannot contribute (that is can't create, modify, or retire) knowledge articles within a knowledge base. The Cannot Contribute user criteria is available only for knowledge bases. |
| Can Contribute | Can contribute (that is can view, create, modify, or retire) knowledge articles within a knowledge base. The Can Contribute user criteria is available only for knowledge bases. |
| Cannot Read | At the knowledge base level, cannot view knowledge articles within a knowledge base. At the knowledge article level, cannot view a knowledge article. |
| Can Read | At the knowledge base level, can view knowledge articles within a knowledge base. At the knowledge article level, can view a knowledge article. |
[Table 1. User criteria definitions]

{#user-access-knowledge__table_m2t_r55_2jb}

The access to knowledge base and its articles are defined based on the user criteria status
for a user as described in the following table.
{#user-access-knowledge__table_ajq_1rj_tjb__entry__2}

| Status | Access |
|-|-|
| The user matches both Can Contribute and Cannot Contribute at the knowledge base level | The user is denied contribute access to the knowledge base and its articles. |
| The user matches both Can Read and Cannot Read at the knowledge base level | The user is denied read access to the knowledge base and its articles. |
| The user matches Can Read at the knowledge base level and Cannot Read at the knowledge article level | The user is denied read access to the knowledge article. |
| The user matches Cannot Read and Can Read at the knowledge article level | The user is denied read access to the knowledge article. |
[Table 2. Combining knowledge base and knowledge article user criteria]

{#user-access-knowledge__table_ajq_1rj_tjb}

## Users with special knowledge privileges {#user-access-knowledge__section_uvc_rqf_sjb}

Users with special knowledge privileges aren't evaluated based on user criteria and have
knowledge bases and knowledge articles access as described in the following table.
{#user-access-knowledge__table_a51_jlv_4jb__entry__2}

| User | Access |
|-|-|
| Knowledge administrator | * Contribute to and read all knowledge bases and their articles. * Modify the definition of all knowledge bases and assign user criteria to them. {#user-access-knowledge__ul_g2g_rqf_sjb} Note: This access doesn't apply to scoped knowledge bases. For more information, see [Scoped knowledge bases](https://www.servicenow.com/docs/XDG5qPmPcTUSUxW3ps9ZaA "To protect knowledge bases containing sensitive articles, use a scoped knowledge base. Even system administrators and knowledge administrators can't administer scoped knowledge bases unless explicitly authorized through user criteria."). |
| Owner of a knowledge base | * Contribute to and read that knowledge base. * Modify the definition of that knowledge base and assign user criteria to it. {#user-access-knowledge__ul_ryw_t1p_qjb} |
| Manager of a knowledge base | * Contribute to and read that knowledge base. * Modify the definition of that knowledge base and assign user criteria to it. {#user-access-knowledge__ul_m2c_hyv_4jb} Note: If the article versioning feature is enabled, the manager of a knowledge base can't modify knowledge articles of other authors that are in the Draft state. For more information, see [Article versioning](https://www.servicenow.com/docs/SCAOMsnwopvGU1xBuxYNOQ "Use the Knowledge Management article versioning feature to create and maintain multiple versions of a knowledge article."). |
| Members of an ownership group associated with a knowledge article | Read, modify, approve, and retire that knowledge article (see [Ownership groups](https://www.servicenow.com/docs/5qm4vVg~buDaLJDlgueUsQ "Configure ownership groups and associate them with knowledge articles to maintain article quality, manage approvals, and for timely resolution of feedback.")). |
[Table 3. Access of users with special privileges to knowledge bases and knowledge articles]

{#user-access-knowledge__table_a51_jlv_4jb}

## Explicit roles and user criteria {#user-access-knowledge__section_bpn_3qj_kjb}

Explicit roles (snc_external and snc_internal) are added to your instance when your
administrator installs a plugin, such as the Customer Service plugin
(com.sn_customerservice), that also activates the Explicit Roles plugin
(com.glide.explicit_roles). If you create a knowledge base with the Explicit Roles plugin
(com.glide.explicit_roles) activated, the application automatically adds the following
predefined user criteria at the knowledge base level:

* Users with 'snc_internal' role -- Added to the Can Read user criteria enabling only users with the snc_internal role have read access to the knowledge base.
* Users with snc_internal' and another role -- Added to the Can Contribute user criteria enabling only users with the snc_internal role and at least one additional role have contribute access to the knowledge base.

{#user-access-knowledge__ul_ry5_ysb_rjb}

When you upgrade to product versions (from Rome onwards) that offer the Explicit Roles plugin (com.glide.explicit_roles), the predefined user criteria Users with 'snc_internal' role and Users with 'snc_internal' and another role aren't automatically added to any existing knowledge bases created prior to the activation of the Explicit Roles plugin. To add these predefined user criteria to an existing knowledge base, run the
Fix unsecured knowledge bases fix script. For more information about explicit roles and fix scripts, see [Explicit Roles](https://www.servicenow.com/docs/access?context=explicit-roles&version=zurich&pubname=zurich-platform-security&ft:locale=en-US) and [Fix scripts](https://www.servicenow.com/docs/access?context=c_FixScripts&version=zurich&pubname=zurich-application-development&ft:locale=en-US).

## Determining contribute access to a knowledge base and its articles using user
criteria {#user-access-knowledge__section_acf_wjx_jjb}

When either Cannot Contribute isn't set or a user doesn't match Cannot Contribute and
additionally Can Contribute is not set, the
glide.knowman.block_access_with_no_user_criteria property value is
further evaluated to determine contribute access, as explained in the following table.
{#user-access-knowledge__table_z2b_hrp_qjb__entry__2}

| Property value | Result |
|-|-|
| true | No user has contribute access to the knowledge base except [users with special knowledge privileges](https://www.servicenow.com/docs/ffhpErJtGvxZsWi4FWrtgg#user-access-knowledge__section_uvc_rqf_sjb). |
| false | All users, including unauthenticated users, with at least one role can contribute to the knowledge base. If the Explicit Roles plugin (com.glide.explicit_roles) is activated, users who have at least one role other than snc_internal can contribute to the knowledge base. To check knowledge bases accessible to unauthenticated users, use the User Criteria Diagnostics feature. For more information, see [Configure access to knowledge bases for unauthenticated users](https://www.servicenow.com/docs/E2tb0r3Cy2adK9F8tLWDNg "Identify knowledge bases accessible to unauthenticated users based on the user criteria and the system property settings."). |
[Table 4. Contribute access to a knowledge base when user criteria for a knowledge base aren't set]

{#user-access-knowledge__table_z2b_hrp_qjb}

When a user has contribute access to a knowledge base, the
glide.knowman.apply_article_read_criteria property is evaluated to
determine contribute access to an article in the knowledge base, as explained in the
following table.
{#user-access-knowledge__table_szq_1pm_3mb__entry__2}

| Property value | Result |
|-|-|
| true | Article-level read access overrides the default contribute permission granted by contribute access at the knowledge base level. |
| false | Contribute access at the knowledge base level takes precedence over article-level user criteria and the user has contribute access to every article in the knowledge base. |
[Table 5. Contribute access to an article when a user has contribute access to a knowledge base]

{#user-access-knowledge__table_szq_1pm_3mb}

## Determining read access to articles in a knowledge base using user criteria {#user-access-knowledge__section_xdd_31t_gmb}

When either Cannot Read isn't set or a user doesn't match Cannot Read and additionally Can
Read is not set, the glide.knowman.block_access_with_no_user_criteria
property value is further evaluated to determine read access, as explained in the following
table.
{#user-access-knowledge__table_gmk_z5s_tjb__entry__2}

| Property value | Result |
|-|-|
| true | No user has read access except [users with special knowledge privileges](https://www.servicenow.com/docs/ffhpErJtGvxZsWi4FWrtgg#user-access-knowledge__section_uvc_rqf_sjb) and users who have contribute access to the knowledge base. |
| false | All users, including unauthenticated users, have read access to the knowledge base and the article-level user criteria are further evaluated. To check knowledge bases accessible to unauthenticated users, use the User Criteria Diagnostics feature. For more information, see [Configure access to knowledge bases for unauthenticated users](https://www.servicenow.com/docs/E2tb0r3Cy2adK9F8tLWDNg "Identify knowledge bases accessible to unauthenticated users based on the user criteria and the system property settings."). |
[Table 6. Read access when user criteria for a knowledge base aren't set]

{#user-access-knowledge__table_gmk_z5s_tjb}

When a user has contribute access to a knowledge base, the
glide.knowman.apply_article_read_criteria property is evaluated to
determine read access to an article in the knowledge base, as explained in the
following table.
{#user-access-knowledge__table_tqt_3mm_3mb__entry__2}

| Property value | Result |
|-|-|
| true | Article-level read access overrides the default read permission granted by contribute access at the knowledge base level. |
| false | Contribute access at the knowledge base level takes precedence over article-level user criteria and the user has read access to every article in the knowledge base. |
[Table 7. Read access to an article when a user has contribute access to a knowledge base]

{#user-access-knowledge__table_tqt_3mm_3mb}  
Important:  
After you add user criteria, you can use the user criteria diagnostics feature to verify the access that users have to a knowledge base or a knowledge article. For more information, see [User criteria diagnostics for Knowledge Management](https://www.servicenow.com/docs/fBZVImguYz3JJD3rF4~mGw "Manage user access to a knowledge base or an article using user criteria diagnostics. Understand what access users have to a knowledge base or an article and determine which user criteria define those permissions.").
* **[Create user criteria for controlling access to knowledge bases and articles](https://www.servicenow.com/docs/0DCV616AiyWB5sbYonDvKw)**   
  Control access to knowledge bases and articles by creating user criteria.
* **[Control access at the knowledge base level through user criteria](https://www.servicenow.com/docs/Oymn3fqZjt_xRKx1UJjZyw)**   
  You specify user criteria for a knowledge base to control which users are granted access to read and contribute knowledge articles to that knowledge base.
* **[Control access at the knowledge article level through user criteria](https://www.servicenow.com/docs/7qIgTh1XYI3jG3O40PObfg)**   
  You specify user criteria for a knowledge article to control which users are granted read access to the knowledge article.

**Related concepts**   

* [Configuration tasks for knowledge managers](https://www.servicenow.com/docs/MMp~xKkAsQnot2IQsT935g "Having multiple knowledge bases allows an organization to spread management responsibilities across multiple users, known as knowledge managers.")  
**Related tasks**   

* [Create user criteria for controlling access to knowledge bases and articles](https://www.servicenow.com/docs/0DCV616AiyWB5sbYonDvKw "Control access to knowledge bases and articles by creating user criteria.")  
**Related reference**   

* [Knowledge Management properties](https://www.servicenow.com/docs/NDkxcDob7JzWm5OBdikqMQ#r_KnowledgeProperties "As an administrator, you can configure the look and functionality of many knowledge base features with Knowledge Management properties.")  
**Related topics**   

* [Knowledge Management FAQ](https://community.servicenow.com/community?id=community_article&sys_id=637ffc92db519490d82ffb24399619f3)