Domain separation and Generative AI Controller

  • Release version: Australia
  • Updated March 12, 2026
  • 4 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Domain Separation and Generative AI Controller

    Domain separation in the Generative AI Controller allows ServiceNow customers to organize data, processes, and administrative tasks into distinct domains. This feature is vital for controlling user access and ensuring that information is segregated according to business needs. It supports a standard level of assistance and is designed to facilitate the management of multiple service provider customers within a single instance.

    Show full answer Show less

    Key Features

    • Data and Process Isolation: Domain separation enables the creation of partitions within application data, restricting access so users within one domain cannot interact with data from another.
    • Customizable Business Logic: The service provider can tailor processes per tenant, allowing for different configurations based on specific customer requirements.
    • OneExtend Capabilities: The generative AI tables are domain-separated, supporting the development of Virtual Agent topics and flows that leverage generative AI functionalities.

    Key Outcomes

    With domain separation, you can effectively create and manage distinct Virtual Agent topics and workflows tailored to specific domains. This functionality enhances data security and operational efficiency, ensuring that the right users have access to the appropriate capabilities. When implementing new capabilities, you can use existing records as templates to streamline the setup process, maintaining consistency across domains.

    Domain separation is supported for Generative AI Controller. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

    Support level: Standard

    • Includes all aspects of Basic level support.
    • Application properties are domain-aware as needed.
    • Business logic: The service provider (SP) creates or modifies processes per customer. The use cases reflect proper use of the application by multiple SP customers in a single instance.
    • The instance owner must configure the minimum viable product (MVP) business logic and data parameters per tenant as expected for the specific application.

    Sample use case: An admin must be able to make comments required when a record closes for one tenant, but not for another.

    For more information on support levels, see Application support for domain separation.

    Domain separation enables you to create partitions in the application data and administrative processes. Because the generative AI tables are domain separated, Generative AI Controller supports domain separation for OneExtend capabilities. The capabilities are the basic building blocks for Virtual Agent Designer topics, components, flows, and scripts that use generative AI. With domain separation, you can isolate the data and control access so that users in one domain don’t have access to the capabilities of another domain.

    For more details on domain separation and Virtual Agent, check out the documentation.

    How domain separation works in Generative AI Controller

    Domain separation is possible at the generative AI OneExtend capability level. Records that are related to the execution and configuration of OneExtend capabilities, such as log tables that are accessible to ServiceNow personnel, are also separated according to the capability's domain.

    If you want to create a copy of an existing generative AI capability in a different domain, you must create a record in the OneExtend Capabilities (sys_one_extend_capability) table. See the reference for Generative AI Controller for more information about the OneExtend Capabilities table.

    You set the domain when the record is created. The domain is based on the domain that you're in at the time that you create the record. When you're creating a capability record, you can use an existing OneExtend Capability record as a blueprint to help confirm that the capability works as intended.

    After you create the OneExtend Capability record, you must create records for the following attribute and config records in the new domain:

    • OneExtend Capability Attribute records with the same values as the capability in the global domain.
    • A OneExtend Capability Definition that corresponds to the new capability.
    • A OneExtend Definition Config definition record that includes the OneExtend Capability Definition for the new domain.

    For more information on setting up OneExtend Definition Configs to use in Virtual Agent Designer, see enabling Generative AI Controller for Virtual Agent.

    You can also create these records by using the related lists in the OneExtend Capability record default view.

    Note:
    The OneExtend Capability Definition record that you add must be the same as the capability that you want in the new domain. For example, if you’re creating a capability in a new domain for sentiment analysis, you could add the Sentiment Analysis (OpenAI Completion) record. Adding the Summarize (OpenAI Completion) Config could result in unexpected behavior. The OneExtend Definition Config record that you select should include the OneExtend Capability Definition record that you added.

    Use cases

    With domain-separated capabilities, you can build different Virtual Agent topics, flows with Workflow Studio, or different background and business rule scripts that are also domain separated.