---
sourceDocument: Australia Enable AI
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/pt-BR/intelligent-experiences

 Release :

    - australia

ft:locale :

    - pt-BR

ft:publication_title :

    - Australia Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Define security controls

# Define security controls for an agentic workflow {#ariaid-title1}

* Versão de lançamento: Australia
* 
* Atualizado 12 de mar. de 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 min. de leitura

In the guided setup for an agentic workflow, define security controls for who can access the agentic workflow and what data the agentic workflow has access to.

## Antes de Iniciar

Role required: sn_aia.admin

## Por Que e Quando Desempenhar Esta Tarefa

The Define security controls step is divided into two parts: Define user access and Define data access. The former creates an access control list (ACL) that determines which users can discover or invoke the agentic workflow. The latter defines the data that the agentic workflow has access to once it's invoked.

See [Security for AI agents](https://servicenow-prod.fluidtopics.net/22j7AP47_LhOTCRi_NkWGw "Implement security controls for AI agents and agentic workflows through access control lists (ACLs) and user identities to increase alignment with the access control-based security measures in the agentic system.") for more information about creating ACLs and user identities for security for agentic workflows.

## Procedimento

1. Select which users can access the agentic workflow.  
   The drop-down menu options are:
   * Users with specified roles
   * Authenticated users
   * Public

   If you select Users with specified roles, you can select exactly which roles can access the agentic workflow. Agentic workflows installed with Now Assist applications and their AI agents might require you to include specific roles. To learn which roles they need, consult the documentation for the AI agent or the agentic workflow that uses the AI agent.


2. Select Save and continue to move to the next step.  
   Saving and moving onto the next step triggers the creation of an ACL for your agentic workflow. If you want to make changes later, you can return to the guided setup and change the options here. If you have the correct elevated role, you can also make edits directly on the ACL table.
3. Define the user identity of the agentic workflow to determine what data it has access to.  
   The two options are Dynamic user and AI user. The dynamic user is the user invoking the agentic workflow. An AI user is a dedicated user that has its own specified roles that allow access, which could be more than the dynamic user.

   If you select Dynamic user, you can select the Approved roles that the AI agent runs with. By default, an AI agent runs as a dynamic user and has the roles of the invoking
   user. Select the approved roles to limit the data access that an AI agent could have. Role masking must be applied for all AI agents and agentic workflows set to run as dynamic users.  
   To override the role masking requirement for a specific agentic workflow or AI agent, admins with the correct elevated access can create an approved list of roles for a given agentic workflow or AI agent. Then, they can access that role masking record in the Agent Access Role Configurations table \[sys_agent_access_role_configuration\], and select the "allow all roles" check box. Taking these steps deactivates the requirement for a role masking approved roles list in AI Agent Studio, so the AI admin can return to AI Agent Studio and continue to configure the agentic workflow or AI agent without role masking applied.  
   Nota:  
   Role masking should be applied as security best practice and adherence to the principle of least privilege. Overriding the role masking requirement isn't recommended.

   If you select AI user, the list of roles that the AI user has is displayed.


## Resultado

You have created an ACL that determines who can discover and access your agentic workflow, and you have assigned a user identity (and role masking, if relevant) to the agentic workflow to determine what data it can
access.

## O que Fazer Depois

Select Save and continue to move to the next step, [Adding a trigger](https://servicenow-prod.fluidtopics.net/WDVfTN6SU4Lmpt7Kom7aqQ "In the guided setup for an agentic workflow, add triggers to run the agentic workflow automatically when certain conditions are met."). Adding a trigger is optional. You can also skip to the final step, [Select channels and access](https://servicenow-prod.fluidtopics.net/V49Jvwm6qzBnryxU0O8vMg "In the guided setup for an agentic workflow, activate the agentic workflow to use in the Now Assist panel or UI actions in the Core UI and workspaces.").