Configuring user access and data permissions for AI agents

concept brazil Updated Sep 10, 2026 1 min read cmpro-conf-users-ai-agents.md

Configure the security controls to specify the users who can discover or use the agentic workflow, and provide data permissions for AI agents.

AI agents use role masking to determine which users can access them. Ones installed with your applications have specific roles that come included with the application. If you select Users with specific roles for user access, you must configure the security controls to include these roles. For the instructions to change the security controls, see Define security controls for an AI agent.

The following roles are configured with the base system to provide data access to the AI agents in the agentic workflows of Contract Management Pro.

sn_cm_gen_ai.ai_contract_fulfiller
sn_lg_cnt.contract_fulfiller
sn_lg_ops.request_fulfiller
sn_cm_core.contract_fulfiller
contract_manager
sn_lg_cnt.contract_owner
sn_cm_obligation.obligation_fulfiller

To ensure that the AI agent can access all the required information for your workspace, add the necessary roles for the AI agent in the AI Agent Studio.

Navigate to All > AI Agent Studio > Create and manage.
Select the AI agents tab.
Open the AI agent for which you want to configure the security controls.
In the guided setup, navigate to Define security controls to define the security access.
1. In the Define user access tab, add the user roles who can discover or invoke the AI agent.
2. In the Define data access tab, add the user roles to define which roles the AI agent uses to access data during its execution.
  
  This configuration controls what information the AI agent can read, update, or share, based on the permissions of the selected roles.

For more information on configuring the security controls, see Define security controls for an AI agent.

Parent Topic:Configuring agentic workflows in ServiceNow Otto for Contract Management Pro

52 lines · 3.4 KB Wrap lines

---
title: Configuring user access and data permissions for AI agents
description: Configure the security controls to specify the users who can discover or use the agentic workflow, and provide data permissions for AI agents.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/employee-service-management/contract-management-pro/cmpro-conf-users-ai-agents.html
release: brazil
product: Contract Management Pro
classification: contract-management-pro
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Configure agentic workflows, Configure AI capabilities, Configure, Contract Management Pro, Legal and Contract Operations, Employee Service Management]
---

# Configuring user access and data permissions for AI agents

Configure the security controls to specify the users who can discover or use the agentic workflow, and provide data permissions for AI agents.

AI agents use [role masking](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/intelligent-experiences/aia-role-masking.md) to determine which users can access them. Ones installed with your applications have specific roles that come included with the application. If you select **Users with specific roles** for user access, you must configure the security controls to include these roles. For the instructions to change the security controls, see [Define security controls for an AI agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/intelligent-experiences/define-sec-controls-aia.md).

The following roles are configured with the base system to provide data access to the AI agents in the agentic workflows of Contract Management Pro.

- sn\_cm\_gen\_ai.ai\_contract\_fulfiller
- sn\_lg\_cnt.contract\_fulfiller
- sn\_lg\_ops.request\_fulfiller
- sn\_cm\_core.contract\_fulfiller
- contract\_manager
- sn\_lg\_cnt.contract\_owner
- sn\_cm\_obligation.obligation\_fulfiller

To ensure that the AI agent can access all the required information for your workspace, add the necessary roles for the AI agent in the AI Agent Studio.

1. Navigate to **All** &gt; **AI Agent Studio** &gt; **Create and manage**.
2. Select the **AI agents** tab.
3. Open the AI agent for which you want to configure the security controls.
4. In the guided setup, navigate to **Define security controls** to define the security access.
1. In the **Define user access** tab, add the user roles who can discover or invoke the AI agent.
2. In the **Define data access** tab, add the user roles to define which roles the AI agent uses to access data during its execution.

This configuration controls what information the AI agent can read, update, or share, based on the permissions of the selected roles.

For more information on configuring the security controls, see [Define security controls for an AI agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/intelligent-experiences/define-sec-controls-aia.md).

**Parent Topic:**[Configuring agentic workflows in ServiceNow Otto for Contract Management Pro](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/employee-service-management/contract-management-pro/cmpro-conf-agentic-workflow.md)

**Related topics**

[Configuring user access and data permissions for agentic workflows](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/employee-service-management/contract-management-pro/cmpro-conf-users-agentic-wf.md)