Skip to main content
Solved

ServiceNow Agent Marketplace Plugins Don't seem to support Permission Mirroring

  • October 16, 2025
  • 3 replies
  • 34 views
Aaron_Vess

My team has recenlty started testing around with installing Agent templates from the Marketplace into our TEST environment. Once particular agent template is Summarize an Incident. When testing this we identified a potential issue where any associate could get a Incident summary for any Incident. I see this as a potential security concern as I wouldn’t want a non ITIL user to be able to see higher severity Incidents as an example.

 

Has anyone else implemented this Agent template? If so, have you had similar experiences or have any idea how to implement the SNOW Role-Based permission mirroring?

Best answer by Kevin Mok

Currently, this plugin uses the ServiceNow connector you set up. I assume it’s either a service account or an OAuth application.

If this account has access to all incidents in the incident table, it can read any incident. The API will then return all the information requested.

This isn’t a Permission Mirroring issue since it’s using a service account or application to retrieve the information.
--

What you can do in this scenario is check access by modifying the plugin to include specific checks. For example, after the user enters the ticket number, you could verify whether they have access to it. Such a workaround would require setting up another API action and implementing decision policies.

3 replies

Kevin Mok
Forum|alt.badge.img+1
  • Kevin Mok
  • Community Manager
  • Answer
  • October 22, 2025

Currently, this plugin uses the ServiceNow connector you set up. I assume it’s either a service account or an OAuth application.

If this account has access to all incidents in the incident table, it can read any incident. The API will then return all the information requested.

This isn’t a Permission Mirroring issue since it’s using a service account or application to retrieve the information.
--

What you can do in this scenario is check access by modifying the plugin to include specific checks. For example, after the user enters the ticket number, you could verify whether they have access to it. Such a workaround would require setting up another API action and implementing decision policies.

    Aaron_Vess
    • Aaron_Vess
    • Author
    • New Participant
    • October 22, 2025

    When you say “...require setting up another API action...” do you mean a new Action within the plugin or a new Connection between Moveworks and SNOW? 

    Kevin Mok
    Forum|alt.badge.img+1
    • Kevin Mok
    • Community Manager
    • October 22, 2025

    A new http action within the plugin flow!

    Terms & ConditionsCookie settingsAccessibility statement