--- sourceDocument: Xanadu ServiceNow AI Platform Administration sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/xanadu/platform-administration Release : - xanadu ft:locale : - en-US ft:publication_title : - Xanadu ServiceNow AI Platform Administration ft:clusterId : - platadm bundleId : - platadm workflow : - Platform --- # External content security # External content security for AI Search {#ariaid-title1} * Release version: Xanadu * * Updated July 16, 2025 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read AI Search preserves user and group security access permissions specified for documents indexed from external sources. You can control access to external content search results by mapping these externally defined users and groups to ServiceNow AI Platform® users. For an overview of AI Search content security, see [Content security in AI Search](https://servicenow-prod.fluidtopics.net/3_aoFfRTt73G75Qdr~gcOQ "AI Search filters search query results and displays only records that the currently logged in user can access."). ## Requirements {#external-content-security-ais__section_r3t_sdg_vpb} To use external content security, include the following two steps in your ingestion and indexing process for external documents: {#external-content-security-ais__table_zhf_1qn_wpb__entry__2} | Step | Description | |-|-| | Specify access permissions on each external document fed for ingestion | Access permissions for an external document can allow or deny access to the document globally (for all users), or can include lists of specific externally defined users and groups who are allowed or denied access to the document. AI Search preserves the external document's security access permissions during indexing. Additional information: * For an overview of specifying access permissions on external documents, see [Defining access permissions for external documents](https://servicenow-prod.fluidtopics.net/d8BQZOHTl0pXtcd4xSXITw#defining-access-perms-ext-docs-ais "You can specify access permissions for externally defined users and groups when ingesting external documents. AI Search preserves these permissions during indexing so that user content security filters can operate on them at search time."). * To learn about the set of access permissions supported for external content security, see [External content access permissions](https://servicenow-prod.fluidtopics.net/d8BQZOHTl0pXtcd4xSXITw#ext-cont-security-perms-ais "External content security includes permissions that describe user and group access for an external document. When indexing an external document, AI Search stores these permissions so that content security filters can limit user access to the indexed search result."). * For details on special access permissions granted by certain user roles, see [Special external content access permissions by role](https://servicenow-prod.fluidtopics.net/d8BQZOHTl0pXtcd4xSXITw#ext-cont-security-role-perms-ais "Certain user roles provide special access permissions for external content indexed records."). * To learn how to reverse the default precedence of users.read and groups.deny access permissions for an external content indexed source, see [Change the precedence of user read and group deny permissions for an external content indexed source](https://servicenow-prod.fluidtopics.net/d8BQZOHTl0pXtcd4xSXITw#change-perms-precedence-idxsrc-ais "Make external group deny access permissions take precedence over external user read access permissions for all external documents ingested through an indexed source."). {#external-content-security-ais__ul_v5l_cqn_wpb} | | Define user mappings in tables linked to external content indexed sources | A user mapping specifies externally defined user and group aliases for a ServiceNow AI Platform user. Link these user mappings to indexed sources for external content. AI Search uses an indexed source's user mappings in conjunction with indexed records' access permissions to determine ServiceNow AI Platform user access for search results from the indexed source. Additional information: * For an overview of user mappings, see [Mapping external users and groups to ServiceNow AI Platform users](https://servicenow-prod.fluidtopics.net/DH5hBkEuEWz2As93qnnCzA#user-mappings-ais "AI Search external user mappings enable you to configure externally defined user and group aliases for ServiceNow AI Platform users. AI Search uses these aliased security principals to apply content security filters that control user access to search results indexed from external documents."). * To learn about the set of externally defined security principal types supported in user mappings, see [External user mapping security principal types](https://servicenow-prod.fluidtopics.net/DH5hBkEuEWz2As93qnnCzA#ext-usr-map-principal-types-ais "AI Search user mapping aliases can include externally defined group and user security principals."). * For instructions on creating a table to store your user mappings, see [Create a user mapping table](https://servicenow-prod.fluidtopics.net/DH5hBkEuEWz2As93qnnCzA#create-user-mapping-tables-ais "Define a table to store externally defined user and group aliases for ServiceNow AI Platform users."). * For instructions on linking your user mapping tables to external content indexed sources, see [Link a user mapping table to an external content indexed source](https://servicenow-prod.fluidtopics.net/DH5hBkEuEWz2As93qnnCzA#link-usrmap-tables-idxsrcs-ais "Specify the user mapping table you want AI Search to use for external documents ingested through an indexed source."). * To learn about importing user mappings via the [AI Search External User Mapping API](https://www.servicenow.com/docs/access?context=ext-user-mapping-api&version=xanadu&pubname=xanadu-api-reference&ft:locale=en-US), see [Importing user mappings](https://servicenow-prod.fluidtopics.net/DH5hBkEuEWz2As93qnnCzA#importing-user-mappings-ais "You can use the AI Search External User Mapping API to import mappings between ServiceNow AI Platform users and externally defined users and groups."). * For instructions on viewing user mapping import history records to confirm that user mappings imported correctly, see [View history records for user mapping import operations](https://servicenow-prod.fluidtopics.net/DH5hBkEuEWz2As93qnnCzA#view-usr-map-import-history-ais "Review the results for your user mapping import operations, including data, log messages, and any errors. Use this procedure to verify that your user mappings are imported correctly."). {#external-content-security-ais__ul_mgk_gqn_wpb} | [ ] {#external-content-security-ais__table_zhf_1qn_wpb} ## Security implementation for search queries {#external-content-security-ais__section_nvy_jnn_wpb} When a user's search query matches an indexed record created from an external document, AI Search performs these steps: 1. Examines the user mappings linked to the record's indexed source and retrieves the set of all externally defined users and groups aliased to the current ServiceNow AI Platform user's account. 2. Compares the mapped set of externally defined user and group aliases with the access permissions on the indexed search result record to see whether the ServiceNow AI Platform user should be allowed to view the search result. {#external-content-security-ais__ol_ldb_vnn_wpb} * **[Defining access permissions for external documents](https://servicenow-prod.fluidtopics.net/d8BQZOHTl0pXtcd4xSXITw#defining-access-perms-ext-docs-ais)** You can specify access permissions for externally defined users and groups when ingesting external documents. AI Search preserves these permissions during indexing so that user content security filters can operate on them at search time. * **[Mapping external users and groups to ServiceNow AI Platform users](https://servicenow-prod.fluidtopics.net/DH5hBkEuEWz2As93qnnCzA#user-mappings-ais)** AI Search external user mappings enable you to configure externally defined user and group aliases for ServiceNow AI Platform users. AI Search uses these aliased security principals to apply content security filters that control user access to search results indexed from external documents.