AI Skill Kit roles

Certain roles are required to use AI Skill Kit functionality.

Role types in AI Skill Kit

Three separate role concepts apply when you build and deploy a custom skill. Understanding the difference helps you plan access before you start and troubleshoot permission errors after you deploy.

• Roles required to use the AI Skill Kit

  Users need specific roles to perform activities in AI Skill Kit, such as installing the plugin, building a skill, or activating a published skill. These roles are assigned to the people on your team who build and manage skills. For a list of the roles required for each activity, see the Roles required for common tasks table.

• Roles required to trigger skills

  Roles that a user must have to trigger a published skill on your instance. These roles are configured within the skill configuration as part of its access control list (ACL). The ACLs are separate from the roles required to build the skill. To learn more, see Configure security controls for a skill.

• Roles that a skill runs under

  The roles that a skill operates with while it runs, which control what data and actions the skill can access on behalf of the triggering user. These are configured on the skill as role restrictions. Role restrictions are also separate from the roles required to build the skill. To learn more, see Configure security controls for a skill.

Two roles ship with AI Skill Kit:

• sn_skill_builder.admin for building, editing, and publishing skills.

• sn_skill_builder.model_admin for managing the LLMs available to skills.

The platform admin role is also required at two points: to install AI Skill Kit and to activate a published skill in AI Admin Hub. In many deployments, one person holds all three roles.

Note: The ACL and role restriction concepts apply to the skill’s runtime users, not to the people building the skill. If you’re planning access for your build team, you only need the roles listed in the Roles required for common tasks table.

Roles required for common tasks in AI Skill Kit

Most work in AI Skill Kit requires the sn_skill_builder.admin role, including creating, cloning, editing, configuring, testing, evaluating, and publishing skills, and calling skills from scripts.

Two activities require the platform admin role instead: installing AI Skill Kit and activating a published skill in AI Admin Hub.

Triggering an activated skill from the UI requires whatever roles are configured in the skill’s ACL. To learn more, see Configure security controls for a skill.

Parent Topic:AI Skill Kit reference

Skill kit admin (sn_skill_builder.admin)

Users with this role can create, update, and publish skills in AI Skill Kit. This role is required to use AI Skill Kit.

Contains roles

None.

Groups

None. This role is not assigned to any groups by default.

Tasks requiring this role

The sn_skill_builder.admin role is required for the following tasks:

• Create a skill

• Clone and edit a ServiceNow skill

• Create a prompt

• Configure a skill prompt

• Configure deployment and skill settings

• Configure security controls for a skill

• Add a tool

• Add a retriever

• Add a web search

• Use prompt assistance

• Test a prompt

• Evaluate a prompt

• Finalize and publish a skill

Special considerations

This role grants access to the AI Skill Kit application and all skill authoring functionality. It does not grant the ability to activate skills in AI Admin Hub. Activating skills requires the admin role.

When configuring access control lists (ACLs) for a skill, the roles you specify in the ACL determine which users can invoke the skill. The sn_skill_builder.admin role only controls who can author skills, not who can use them. To learn more about configuring skill ACLs, see Configure security controls for a skill.

Skill Kit model admin (sn_skill_builder.sb_model_admin)

Users with this role can create and update the custom large language models (LLMs) available to skills.

Contains roles

List of roles contained within the role.

None.

Groups

None. This role is not assigned to any groups by default.

Special considerations

This role is only required when working with custom large language models. AI developers who use the standard Now LLM Service provider or prebuilt external LLM spokes do not need this role. To learn more about provider options when creating a skill, see Create a skill.

This role does not replace the sn_skill_builder.admin role. AI developers who create skills using custom large language models require both roles.