{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40210,"path":"platform-administration/user-administration/base-system-roles.md","title":"System roles","bundle":null,"doc_type":null,"release":"australia","body":"\n# System roles\n\nAdministrators can control access to features and capabilities on a ServiceNow instance by assigning roles to users.\n\nYour ServiceNow includes roles to grant access to the platform features and applications included a base system instance. Applications you install on your instance may include additional roles to control access to those installed features. For more information about roles, see [Exploring user administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-administration/user-administration/exploring-user-administration.md).\n\n**Important:** Base system and roles installed with applications can be deactivated by administrators, but can’t modify or rename these roles.\n\n## Base system roles\n\nBase system roles are present in all ServiceNow instances and don’t require the installation of additional plugins.\n\n\n
\n\nRole\n\n\n\nDescription\n\n
\n\nadmin\n\n\n\nThe system administrator role. This role has access to all system features, functions, and data because administrators can override access control list \\(ACL\\) rules and pass all role checks. Avoid assigning this role to your users when more targeted roles are available.\n\n **Warning:** Grant this privilege carefully. If you have sensitive information, such as HR records, that you need to protect, you must create a custom admin role for that area. You must also train any users authorized to see those records to act as the administrator. Also note the [Special Administrative Roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-administration/user-administration/r_SpecialAdministrativeRoles.md).\n\n
\n\nagent\\_admin\n\n\n\nAgent administrators can download and administer the system's built-in agent. They can manage MID Server-related scripts.\n\n
\n\nais\\_admin\n\n\n\nAI search administrators can query, create, update, and delete indexing and search settings and log messages through the [AI Search](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-administration/ai-search/overview-ais.md) application.\n\n
\n\napproval\\_admin\n\n\n\nApproval administrators can view or modify approval requests not directly assigned to them. Use the approver\\_user role to enable approvers to only view or modify requests directly assigned to them. Use of this role requires a Fulfiller license. Use of the approver\\_user role requires an Approver license.\n\n
\n\napprover\\_user\n\n\n\nApprover users can modify requests for approval routed to them. They also have all capabilities of requesters.**Note:** There’s a fee associated with this role. Don’t assign it to users without confirming your organization has the appropriate entitlement.\n\n
\n\nassignment\\_rule\\_admin\n\n\n\nAssignment rule administrators can manage assignment rules.\n\n
\n\nasset\n\n\n\nAsset users can manage hardware and software assets.\n\n
\n\nbusiness\\_process\\_admin\n\n\n\nBusiness process admins can create, read, update, and delete all records and their relationships in the business process.\n\n In the context of Governance, Risk, and Compliance \\(GRC\\), users with the sn\\_grc.admin role who manage GRC applications and their setup automatically gain access to this role. This access enables the GRC administrators to administer a business process and its records similar to other GRC tables.\n\n **Important:** This role is assigned to users who are administrators and have thorough information and training on business processes.\n\n
\n\nbusiness\\_process\\_manager\n\n\n\nBusiness process managers can create, read, and update any business process and manage the relationship of business processes with other records. This role is assigned to business process managers who are usually specialists and manage multiple business processes in the organization. These users generally work with other employees and are experts around business processes.\n\n In the context of GRC, users with the sn\\_grc.manager role automatically inherit this role that enables them to manage the business processes for the entire organization.\n\n
\n\nbusiness\\_process\\_user\n\n\n\nBusiness process users can update the business processes that a user owns and can also read any business process. This role must be assigned to the respective process owners who manage the business process that they own. This role can also be provided to users who are required to view the business processes in the organization and understand them better.\n\n In the context of GRC, users with the sn\\_risk.user role are automatically assigned this role as this role enables them to manage the business processes they own as well as read all business processes.\n\n
\n\ncatalog\n\n\n\nCatalog users can access service catalog requests.\n\n
\n\ncatalog\\_admin\n\n\n\nCatalog administrators can manage the Service Catalog application, including catalog categories and items.\n\n
\n\ncatalog\\_editor\n\n\n\nCatalog editors can create, modify, and publish items within categories that they’re assigned to.\n\n
\n\ncatalog\\_item\\_designer\n\n\n\nCatalog item designers can view the status of their category requests. This role is granted automatically to users when they make a request for an item designer category.\n\n
\n\ncatalog\\_manager\n\n\n\nCatalog managers can view and assign catalog editors to their categories. Can also create, modify, and publish items within their categories.\n\n
\n\ncategory\\_manager\n\n\n\nCategory managers can create, edit, and delete model categories.\n\n
\n\ncmdb\\_dedup\\_admin\n\n\n\nCMDB de-duplication admins can review and remediate CMDB de-duplication tasks.\n\n
\n\ncmdb\\_ms\\_user\n\n\n\nCMDB multiscource readers can access and run a multi-source CMDB query, but can't create a query. This role contains Contains cmdb\\_read role.\n\n
\n\ncmdb\\_ms\\_editor\n\n\n\nCan create and run a query, has full read and write access, but can't do Recompute. Contains cmdb\\_ms\\_read role.\n\n
\n\ncmdb\\_ms\\_admin\n\n\n\nCan create and run a query, and can modify CMDB 360 properties. Contains cmdb\\_ms\\_write role.\n\n
\n\ncmdb\\_read\n\n\n\nCan read any CMDB table. Contained in admin and itil.\n\n
\n\ncommunication\\_manager\n\n\n\nManages communication for major incidents and is responsible for communicating with all stakeholders.\n\n
\n\ncontract\\_manager\n\n\n\nCan create, edit, and delete contracts through the Contract Management application.\n\n
\n\ndata\\_classification\\_admin\n\n\n\nAdministers all aspects of the Data Classification application, data classification code setup and assignment,\n\n
\n\ndata\\_classification\\_auditor\n\n\n\nAudits Data Classification code assignments.\n\n
\n\necmdb\\_admin\n\n\n\nCan administer the CMDB.\n\n
\n\nfilter\\_admin\n\n\n\nCan manage filters.\n\n
\n\nfilter\\_global\n\n\n\nCan create global filters.\n\n
\n\nfilter\\_group\n\n\n\nCan create filters that belong to groups of which the user is a member.\n\n
\n\ngauge\\_maker\n\n\n\nCan create gauges from reports. Starting with Helsinki, reports are no longer made into gauges.\n\n
\n\nguided\\_tour\\_admin\n\n\n\nCan manage and administer Guided Tour functionality.\n\n
\n\nimage\\_admin\n\n\n\nCan manage image files on the Images \\[db\\_image\\] table.\n\n
\n\nimpersonator\n\n\n\nCan impersonate users. This role doesn't allow impersonation of admin users.\n\n
\n\nimport\\_admin\n\n\n\nCan manage all aspects of import sets and imports.\n\n
\n\nimport\\_scheduler\n\n\n\nCan schedule imports. **Warning:** Grant this role carefully. The import\\_scheduler role is equivalent to giving the user the admin role, because the import\\_scheduler has the ability to execute scripts with administrator level privileges.\n\n
\n\nimport\\_set\\_loader\n\n\n\nCan load import sets.\n\n
\n\nimport\\_transformer\n\n\n\nCan manage import set transform maps and run transforms.\n\n
\n\nincident\\_manager\n\n\n\nManages Incident properties and Major Incident trigger rules.\n\n
\n\ninventory\\_admin\n\n\n\nCan create and delete stock information. Only users with the inventory\\_admin role can edit stock rules, stockrooms, and stockroom types.\n\n
\n\ninventory\\_user\n\n\n\nHas access to stock information. Can create and manage transfer orders.\n\n
\n\nitil\n\n\n\nCan perform standard actions for an ITIL helpdesk technician. Can open, update, close incidents, problems, changes, configuration management items. By default, only users with the itil role can have tasks assigned to them.\n\n
\n\nitil\\_admin\n\n\n\nPossesses more privileges than the itil role and is intended for team leads. This role has the ability to delete incidents, problems, changes, and other related entities when both the itil and itil\\_admin roles are assigned. In addition, the itil\\_admin role grants full control of the CMDB. The itil\\_admin role includes all of the permissions granted to the sn\\_cmdb\\_admin role, which provides full access to CMDB data, tools, and UIs.\n\n
\n\nknowledge\n\n\n\nCan create, edit, and review knowledge base articles.\n\n
\n\nknowledge\\_admin\n\n\n\nCan manage the knowledge base.\n\n
\n\nlist\\_updater\n\n\n\nCan use Update Entire List and Update Selected menu options on lists.\n\n
\n\nmaint\n\n\n\nReserved for ServiceNow use.\n\n
\n\nmid\\_server\n\n\n\nRole that any MID server user should be granted. This role gives the MID server access to the tables it ordinarily uses.\n\n
\n\nmodel\\_manager\n\n\n\nCan create CMDB models. Model manager can control the base models and any model extensions that aren’t software or consumables. Consumable models are controlled by the asset manager role \\(asset\\). Software models are control by the software asset manager role \\(SAM\\).\n\n
\n\nmajor\\_incident\\_manager\n\n\n\nInitiates the major incident process by assessing and approving major incident candidates or creating a major incident. Maintains the ownership and accountability for the life cycle of the incident. Identifies the users and groups to be involved in the resolution activities and sets up communication channels.\n\n
\n\nnobody\n\n\n\nThe nobody role means that no user has access - not even admin or maint. Use the nobody role carefully. The nobody role takes precedence over the admin override option on ACLs, so even admins can’t have access. See [Create an ACL rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-security/t_CreateAnACLRule.md).\n\n Don’t assign it to specific users. You can use this role in ACLs that control access to resources, such as UI pages, processors, script includes, and records.\n\n **Warning:** Applying the nobody role may be irreversible if applied to some important system functions.\n\n
\n\npersonalize\n\n\n\nCan configure forms, lists, rules, controls, scripts.\n\n
\n\npersonalize\\_choices\n\n\n\nCan configure [choices](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-administration/t_ViewChoiceListDefinitions.md) and predefined responses for non-journal fields designated as choice or suggestion fields.\n\n
\n\npersonalize\\_control\n\n\n\nCan [configure controls](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-administration/list-administration/t_ConfigureListControls.md) on lists, such as filters, links, and buttons.\n\n
\n\npersonalize\\_dictionary\n\n\n\nCan configure dictionary entries and [labels](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-administration/t_ChangeFieldLabelOrHint.md).\n\n
\n\npersonalize\\_form\n\n\n\nCan [configure forms](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-administration/configure-form-layout.md).\n\n
\n\npersonalize\\_list\n\n\n\nCan [configure lists](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-administration/list-administration/t_ConfigureTheListLayout.md) and list [calculations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-administration/list-administration/t_ConfigureListCalculations.md).\n\n
\n\npersonalize\\_responses\n\n\n\nCan configure predefined responses for [journal fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-administration/c_JournalFields.md) designated as suggestion fields.\n\n
\n\npersonalize\\_rules\n\n\n\nCan configure business rules and scripts. This role contains the following specialized roles for granting selective, administrative access to rules and scripts:- business\\_rule\\_admin\n- client\\_script\\_admin\n- ui\\_policy\\_admin\n- ui\\_action\\_admin\n\n
\n\npersonalize\\_styles\n\n\n\nCan configure [field styles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-administration/t_DefineFieldStyles.md).\n\n
\n\npersonalize\\_ui\n\n\n\nCan configure forms and lists.\n\n
\n\npublic\n\n\n\nNo login is required to access features or functions with the public role.\n\n
\n\nrelease\\_admin\n\n\n\nCan edit Release history for a release.\n\n
\n\nreport\\_admin\n\n\n\nCan manage reports.\n\n
\n\nreport\\_global\n\n\n\nCan create global reports.\n\n
\n\nreport\\_group\n\n\n\nCan create reports and share reports with groups that the user is a member of. Users with this role can edit reports shared by other users in the group.\n\n
\n\nreport\\_publisher\n\n\n\nCan make reports available on a public page.\n\n
\n\nreport\\_scheduler\n\n\n\nCan schedule a report to be emailed.\n\n
\n\nscript\\_fix\\_admin\n\n\n\nCan create and manage fix scripts but can’t run fix scripts.\n\n
\n\nsearch\\_application\\_admin\n\n\n\nCan query, create, update, and delete records on search UX-related tables. Contains the ais\\_admin role.\n\n
\n\nsn\\_appclient.app\\_client\\_company\\_installer\n\n\n\nCan install applications containing the same company as the currently logged in instance. User role that enables first-time installation of applications for the company associated with the current instance. A user with this role can’t install an application for another company.\n\n
\n\nsn\\_appclient.app\\_client\\_user\n\n\n\nCan install applications containing the same company as the currently logged in instance.\n\n
\n\nsn\\_cmdb\\_admin\n\n\n\nProvides full access to CMDB data, tools, and UIs. A CMDB Admin, for example, sets policies in the CI Class Manager and application service requirements. CMDB Admin provides the highest level of access to the CMDB.\n\n
\n\nsn\\_cmdb\\_editor\n\n\n\nProvides access to CMDB records. A CMDB Editor can't change policies such as in the CMDB Data Manager or in the CI Class Manager.\n\n
\n\nsn\\_cmdb\\_user\n\n\n\nProvides read-only access to CMDB data and to basic UIs such as CMDB reports and dashboards.\n\n
\n\nsoap\n\n\n\nCan query, create, update, and delete records on all tables, as well as execute scripts.\n\n
\n\nsoap\\_create\n\n\n\nCan create records on all tables and columns.\n\n
\n\nsoap\\_delete\n\n\n\nCan delete records on all tables and columns.\n\n
\n\nsoap\\_ecc\n\n\n\nCan query, create, and update on the ECC Queue table only.\n\n
\n\nsoap\\_query\n\n\n\nCan query records on all tables and columns.\n\n
\n\nsoap\\_query\\_update\n\n\n\nCan query and update records on all tables and columns.\n\n
\n\nsoap\\_script\n\n\n\nCan execute business rule endpoint function via script.do.\n\n
\n\nsoap\\_update\n\n\n\nCan update records on all tables and columns.\n\n
\n\nsurvey\\_admin\n\n\n\nCan see all Surveys, their definitions, questions, instances created by them and others. Survey administrators can use all modules in the Survey application menu.\n\n
\n\nsurvey\\_reader\n\n\n\nUsers with survey reader role can view surveys and related information, such as survey responses, survey groups, scorecards, and reports. Survey\\_reader can’t change or modify a survey or survey responses.\n\n
\n\ntask\\_editor\n\n\n\nCan edit protected task fields.\n\n
\n\ntemplate\\_editor\n\n\n\nCan create templates for personal use, and modify or delete personal templates. Included in the itil role in the base system.\n\n
\n\ntemplate\\_editor\\_global\n\n\n\nCan create templates for global use.\n\n
\n\ntemplate\\_editor\\_group\n\n\n\nCan create templates for groups.\n\n
\n\ntemplate\\_scheduler\n\n\n\nCan schedule template-based record creation.\n\n
\n\ntext\\_search\\_admin\n\n\n\nCan customize Global Text Search groups and tables.\n\n
\n\ntimecard\\_admin\n\n\n\nCan approve, modify, and delete the time cards of other users.\n\n
\n\nts\\_admin\n\n\n\nCan administer [Zing text indexing and search engine](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-administration/search-administration/c_ZingTextSearch.md).\n\n
\n\nunlimited\\_createnow\n\n\n\nRole for CreateNow unlimited licensed users.\n\n
\n\nupgrade\\_app\n\n\n\nCan upgrade installed applications containing the same company as the currently logged in instance. Can’t perform first-time installations of applications published to the Application Client page.\n\n
\n\nuser\n\n\n\nAvailable for customer use, has no function in the base system.\n\n
\n\nuser\\_admin\n\n\n\nCan administer users, groups, locations, and companies.\n\n
\n\nview\\_changer\n\n\n\nCan switch active views.\n\n
\n\nworkflow\\_admin\n\n\n\nCan create, edit, publish, or delete graphical workflows.\n\n
\n\nworkflow\\_creator\n\n\n\nCan create new graphical workflows.\n\n
\n\nworkflow\\_publisher\n\n\n\nCan publish graphical workflows.\n\n
## Application-specific roles\n\nApplications you install on your instance may include additional roles. Follow the links in this section to see roles documentation on roles installed along with applications.\n\n|Product|Application|\n|-------|-----------|\n|Platform Capabilities|[Advanced Work Assignment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/conversational-interfaces/installed-with-awa.md)|\n\n**Parent Topic:**[Managing roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-administration/user-administration/ua-creating-roles.md)\n\n"}}