---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enable Role Masking for Agents

# Enable Role Masking for Agents {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Use a system property to enable the role masking feature.
Use the identity.agent.role_masking.enabled system property to enable the role masking feature. Role masking limits the roles that an AI agent uses when executing tasks. This configuration helps to prevent
unnecessary access to resources not needed within the context of an agent. When this property isn't set to <kbd class="ph userinput">true</kbd>, agents automatically inherit all roles from the user invoking them, potentially increasing the
risk of privilege escalation and accidental data exposure.

Ensure that the identity.agent.role_masking.enabled system property exists in the System Properties \[sys_properties\] table and is set to a value of <kbd class="ph userinput">true</kbd>.

## More information {#sc-enable-role-masking-for-agents__section_qhx_1b1_xwb}

{#sc-enable-role-masking-for-agents__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | identity.agent.role_masking.enabled |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | false |
| Category | [Access control](https://servicenow-prod.fluidtopics.net/xAmazkRh5FKyeb7q4TQGWw "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Security risk | * Severity score: 5 * CVSS score: Medium * Security risk details: When this property isn't set to <kbd class="ph userinput">true</kbd>, agents automatically inherit all roles from the user invoking them. It may increase the risk of privilege escalation and accidental data exposure. {#sc-enable-role-masking-for-agents__ul_g1g_3sf_xwb} |
| Functional Impact | If misconfigured, restrictive role masking may block intended access to a resource. |
| Dependencies and prerequisites | None |
[ ]

{#sc-enable-role-masking-for-agents__table_ajc_b43_3kb}