Check role access for an encrypted column with ServiceNow Otto for Vault

task australia Updated Sep 10, 2026 1 min read check-role-access-now-assist-vault.md

Use the check role access for encrypted column skill to identify user roles that have access to encryption and decryption keys in your instance.

Before you begin

Install ServiceNow Vault. For more information, see Configuring ServiceNow Vault.
Ensure that the check role access for encrypted column skill is active. For more information, see Activate an AI skill.

Roles required: sn_vault_console.vault_console_admin and security_admin

Note: The security_admin role isn't included in the sn_vault_console.vault_console_admin role composition and doesn't appear in the Elevate role list. A user with the admin role must assign it through the standard user-administration process. If the skill reports that you don't have the security_admin role, or that the role isn't active for your session, contact your admin. For more information, see ServiceNow Vault roles.

Procedure

Navigate to All > Vault > Vault console.
In the ServiceNow Otto panel, select Check role access for encrypted column and specify the details.

Example prompt: Which roles have decryption key access to an encrypted column? Access includes read access.

Parent Topic:Use generative AI skills in ServiceNow Otto for Vault

37 lines · 2.4 KB Wrap lines

---
title: Check role access for an encrypted column with ServiceNow Otto for Vault
description: Use the check role access for encrypted column skill to identify user roles that have access to encryption and decryption keys in your instance.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/platform-security/check-role-access-now-assist-vault.html
release: australia
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Use generative AI skills, ServiceNow Vault]
---

# Check role access for an encrypted column with ServiceNow Otto for Vault

Use the check role access for encrypted column skill to identify user roles that have access to encryption and decryption keys in your instance.

## Before you begin

- Install ServiceNow Vault. For more information, see [Configuring ServiceNow Vault](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/configuring-servicenow-vault.md).
- Ensure that the check role access for encrypted column skill is active. For more information, see [Activate an AI skill](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/configure-a-now-assist-skill.md).

Roles required: sn\_vault\_console.vault\_console\_admin and security\_admin

**Note:** The `security_admin` role isn't included in the `sn_vault_console.vault_console_admin` role composition and doesn't appear in the Elevate role list. A user with the admin role must assign it through the standard user-administration process. If the skill reports that you don't have the `security_admin` role, or that the role isn't active for your session, contact your admin. For more information, see [ServiceNow Vault roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/vault-roles.md).

## Procedure

1. Navigate to **All** &gt; **Vault** &gt; **Vault console**.

2. In the ServiceNow Otto panel, select **Check role access for encrypted column** and specify the details.

Example prompt: `Which roles have decryption key access to an encrypted column? Access includes read access.`

**Parent Topic:**[Use generative AI skills in ServiceNow Otto for Vault](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/using-now-assist-vault.md)