Configuring user access and data permissions for agentic workflows

concept brazil Updated Sep 10, 2026 1 min read cmpro-conf-users-agentic-wf.md

Configure the security controls to specify the users who can discover or use the agentic workflow, and provide data permissions for the agentic workflow.

Agentic workflows and their AI agents use role masking to determine which users can access them. Ones installed with your applications have specific roles that come included with the application. If you select Users with specific roles for user access, you must configure the security controls to include these roles. For the instructions to change the security controls, see Define security controls for an agentic workflow.

In ServiceNow Otto for Contract Management Pro, the following roles are configured with the base system to provide data access to the agentic workflows in Contract Management Pro.

sn_cm_gen_ai.ai_contract_fulfiller
sn_lg_cnt.contract_fulfiller
sn_lg_ops.request_fulfiller
sn_cm_core.contract_fulfiller
contract_manager
sn_lg_cnt.contract_owner
sn_cm_obligation.obligation_fulfiller

To ensure that the agentic workflow can access all the required information for your workspace, add the necessary roles for the agentic workflow in the AI Agent Studio.

Navigate to All > AI Agent Studio > Create and manage.
Select the Agentic workflows tab.
Open the agentic workflow for which you want to configure the security controls.
In the guided setup, navigate to Define security controls to define the security access.
1. In the Define user access tab, add the user roles who can discover or invoke the agentic workflow.
2. In the Define data access tab, add the user roles to define which roles the agentic workflow uses to access data during its execution.
  
  This configuration controls what information the agentic workflow can read, update, or share, based on the permissions of the selected roles.

For more information on configuring the security controls, see Define security controls for an agentic workflow.

Parent Topic:Configuring agentic workflows in ServiceNow Otto for Contract Management Pro

52 lines · 3.6 KB Wrap lines

---
title: Configuring user access and data permissions for agentic workflows
description: Configure the security controls to specify the users who can discover or use the agentic workflow, and provide data permissions for the agentic workflow.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/employee-service-management/contract-management-pro/cmpro-conf-users-agentic-wf.html
release: brazil
product: Contract Management Pro
classification: contract-management-pro
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Configure agentic workflows, Configure AI capabilities, Configure, Contract Management Pro, Legal and Contract Operations, Employee Service Management]
---

# Configuring user access and data permissions for agentic workflows

Configure the security controls to specify the users who can discover or use the agentic workflow, and provide data permissions for the agentic workflow.

Agentic workflows and their AI agents use [role masking](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/intelligent-experiences/aia-role-masking.md) to determine which users can access them. Ones installed with your applications have specific roles that come included with the application. If you select **Users with specific roles** for user access, you must configure the security controls to include these roles. For the instructions to change the security controls, see [Define security controls for an agentic workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/intelligent-experiences/define-sec-controls-aw.md).

In ServiceNow Otto for Contract Management Pro, the following roles are configured with the base system to provide data access to the agentic workflows in Contract Management Pro.

- sn\_cm\_gen\_ai.ai\_contract\_fulfiller
- sn\_lg\_cnt.contract\_fulfiller
- sn\_lg\_ops.request\_fulfiller
- sn\_cm\_core.contract\_fulfiller
- contract\_manager
- sn\_lg\_cnt.contract\_owner
- sn\_cm\_obligation.obligation\_fulfiller

To ensure that the agentic workflow can access all the required information for your workspace, add the necessary roles for the agentic workflow in the AI Agent Studio.

1. Navigate to **All** &gt; **AI Agent Studio** &gt; **Create and manage**.
2. Select the **Agentic workflows** tab.
3. Open the agentic workflow for which you want to configure the security controls.
4. In the guided setup, navigate to **Define security controls** to define the security access.
1. In the **Define user access** tab, add the user roles who can discover or invoke the agentic workflow.
2. In the **Define data access** tab, add the user roles to define which roles the agentic workflow uses to access data during its execution.

This configuration controls what information the agentic workflow can read, update, or share, based on the permissions of the selected roles.

For more information on configuring the security controls, see [Define security controls for an agentic workflow](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/intelligent-experiences/define-sec-controls-aw.md).

**Parent Topic:**[Configuring agentic workflows in ServiceNow Otto for Contract Management Pro](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/employee-service-management/contract-management-pro/cmpro-conf-agentic-workflow.md)

**Related topics**

[Configuring user access and data permissions for AI agents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/employee-service-management/contract-management-pro/cmpro-conf-users-ai-agents.md)