{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":35412,"path":"now-intelligence/create-acls-protected-scope-access.md","title":"Create ACLs for AI Data Explorer and Query Generation protected scope access","bundle":null,"doc_type":null,"release":"australia","body":"\n# Create ACLs for AI Data Explorer and Query Generation protected scope access\n\nCreate Access Control Lists \\(ACLs\\) in protected scopes to enable AI Data Explorer and Query Generation to access tables within those scopes.\n\n## Before you begin\n\nYou must have administrator access to the protected scope where you want to enable AI Data Explorer and Query Generation functionality.\n\nRole required: admin or scope-specific administrator role\n\n## About this task\n\nProtected scopes require their own ACLs that mirror the functionality provided by AI Data Explorer and Query Generation standard ACLs. These ACLs must call a public script include provided by the AI Data Explorer plugin to verify proper access control.\n\n**Note:** For simplicity, the following steps use the Insert and Stay feature on existing paai\\_canvas\\_component ACLs. You can also use the information in this procedure to create the four necessary ACLs from scratch.\n\n## Procedure\n\n1.  Switch your current scope to the protected scope where you want to enable AI Data Explorer and Query Generation access.\n\n    For example, switch to the Human Resources Core scope or Employee Profile scope.\n\n2.  Navigate to **System Security** > **Access Control \\(ACL\\)**.\n\n3.  Filter the list of access controls on the **Name** field for paai\\_canvas\\_component.\n\n4.  Create four ACL records for your application scope: one each for read, write, delete, and create operations.\n\n    1.  Open the paai\\_canvas\\_component record for the write operation.\n\n        Ignore the warning that you're in the wrong scope to edit it.\n\n    2.  Expand the Additional Actions menu.\n\n        \\[Omitted image \"access-control-additional-actions.png\"\\] Alt text: Additional Actions menu for a paai\\_canvas\\_component Access Control record.\n\n    3.  Select **Insert and Stay**.\n\n        A new Access Control record opens. It has the same field values as the original record, but it is in your current application scope.\n\n    4.  Add security checks, roles, or data conditions as required by your organization's security policies.\n\n    5.  In the Advanced Condition section, change the script as follows:\n\n        -   Change the name of the script that is called from `AICanvasACLUtil()` to `AICanvasACLUtilPublic()`.\n        -   Change the parameter of the `canEditCanvas` method call to only pass the component `(current)`, not to call `toString()`.\n        The script should be:\n\n        ```javascript\n        answer = new sn_pa_ai_canvas.AICanvasACLUtilPublic().canEditCanvas(current);\n        ```\n\n    6.  Repeat the process for the other operations, using these scripts:\n\n        |Operation|Script|\n        |---------|------|\n        |read|`answer = new sn_pa_ai_canvas.AICanvasACLUtilPublic().canReadComponent(current);`|\n        |create|`answer = new sn_pa_ai_canvas.AICanvasACLUtilPublic().canEditCanvas(current);` \\(Same as write\\)|\n        |delete|`answer = new sn_pa_ai_canvas.AICanvasACLUtilPublic().isRecordOwner(current);`|\n\n        These scripts check whether the user has read access, has edit access, or is the component owner, respectively.\n\n5.  Confirm that each ACL is active and properly configured.\n\n\n## Result\n\nAI Data Explorer and Query Generation can now access tables within the protected scope, subject to the security restrictions defined in the ACLs. Users with appropriate permissions can create and read AI Data Explorer records for tables in the protected scope.\n\n## What to do next\n\nYou must also create and approve Restricted Caller Access \\(RCA\\) records to enable Query Generation to fetch data from protected scope tables through API calls.\n\n**Parent Topic:**[Enabling access to protected scope applications for AI Data Explorer and Query Generation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/now-intelligence/enable-aide-secure-scope-apps.md)\n\n**Previous topic:**[Enabling access to protected scope applications for AI Data Explorer and Query Generation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/now-intelligence/enable-aide-secure-scope-apps.md)\n\n**Next topic:**[Approve RCA records for AI Data Explorer and Query Generation protected scope access](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/now-intelligence/create-rca-records-protected-scope-access.md)\n\n"}}