SoftTech AI Registry
ServiceNow · ServiceNow Otto for Setup

Group and Roles Assignment AI Agent

Prebuilt ServiceNow Otto for Setup AI agent, listed among the Setup Hub AI agents, documented as provisioning access by creating groups, adding users to a group, assigning roles to a group and adding users to a role.

Recorded characteristics

Function
ServiceNow documents this prebuilt agent as a ServiceNow Otto for Setup AI agent that "provisions access by creating groups, adding users to a group, assigning roles to a group, and adding users to a role". The documented workflow is to run the Fetch context tool and present choices to the user, then execute assignments according to the prescribed guardrails. Documented tools include scripts for Add users to a group, Add users to a role, Assign roles to a group, Classify managers from users, Create group, Fetch context, Lookup group information, Lookup role details, Lookup role-group mappings and a User role or group assignment completion validator, a generative AI skill (Discover roles for capability) and a Knowledge Graph lookup (User Graph Entity Lookup).
Data access
ServiceNow documents lookup tools for group information, role details, role-group mappings and a User Graph Entity Lookup knowledge-graph entity. The agent reference page lists "Data access roles" as "Not defined." A separate long-term memory setting, off by default for this agent, is documented as using all previous user interactions as context for the LLM when enabled. ServiceNow does not, in the documentation reviewed, establish the specific record scope this agent reads at runtime beyond these tools.
Actions
Can take actions
External actions
Unknown
Human confirmation
Not established
Permission basis
Not established
Administrative control
ServiceNow documents administrator-facing configuration on the agent reference page: "Allow third party to access this AI agent" (off by default, External discoverable field in the AI Agent configs [sn_aia_agent_config] table), "Allow AI specialists to access this AI agent" (off by default, Specialist enabled field), and "Manage long-term memory" (off by default, sn_aia.ltm.enable_long_term_memory system property). Allowed user roles is documented as sn_ia_config.ia_user. Triggers are documented as optional with none defined by default; an admin can specify triggers. Channels are configured for Virtual Agent or the ServiceNow Otto panel using Assistant Designer. Platform-level controls documented elsewhere for AI agents generally include ACLs (who may invoke an agent), user identities (AI user or dynamic user) and role masking (an approved-roles allow-list applied only to components running as dynamic users); administering AI agents requires the sn_aia.admin role.
Default state
Not established
Availability
Documented in the current ServiceNow product documentation (Australia release, agent reference page updated 14 August 2026) and listed on the Setup Hub AI agents page (updated 4 August 2026). ServiceNow Otto AI Agents installation documentation states an instance requirement of Australia Patch 1 or later, that AI Search must be enabled, that the ServiceNow Otto panel must be turned on, that AI agents are delivered through ServiceNow Otto applications rather than as a standalone install, and that the sn_aia.admin role is required to install and administer them. Regional availability is not established for this agent in the documentation reviewed.
Licensing
ServiceNow states a license requirement of a ServiceNow Otto Pro Plus or Enterprise Plus license for ServiceNow Otto AI Agents, and that a ServiceNow Otto license is required. No capability-specific pricing is established.
External model or provider
Not publicly established for this capability. The agent reference page describes a generative AI skill and long-term memory context passed to "the LLM" but does not identify a runtime model or provider for this agent.
Limitations and uncertainty
ServiceNow states that the agent "never creates or edits users or roles, and it never deletes or modifies any existing content". That stated limitation does not mean the agent makes no persistent changes: creating a group and assigning users and roles are themselves persistent changes to ServiceNow identity and access state. Unresolved: ServiceNow does not establish, for this specific agent, whether a human confirmation step is required before a group is created or an assignment is executed; "present choices to the user" and "prescribed guardrails" are documented but the guardrails are not specified in the agent reference page. Runtime identity is also unresolved: Data access roles is "Not defined." on the agent reference page, and the platform mechanisms (AI user identity, dynamic user, role masking) are documented at platform level without being attributed to this agent. The distinction matters: Allowed user roles (sn_ia_config.ia_user) and ACLs govern who may invoke the agent, not the authority the agent executes with. Triggers are optional and none are defined by default, so unattended or background execution is not established for this agent even though the platform supports scheduled and other trigger types. No consequential writes to systems outside ServiceNow are documented; the documented operations concern ServiceNow identity and access records only.

Evidence