Configure roles for the Service Mapping MCP tools
Configure the role containment chain and assign the required roles to users so they can connect to the CMDB MCP Server and call the Service Mapping MCP tools.
Before you begin
Before activating the CMDB MCP Server, confirm the following requirements are met.
- Verify that Australia Patch 3 is installed.
- You have the MCP Platform Manager version 1.4.0 (or later) plugin activated.
- You have the CMDB MCP Server [sn_cmdb_mcp_server], version 1.0.0, application installed.
Role required: admin
About this task
For information about the Service Mapping tools, see Service Mapping MCP tools.
The REST API ACL for the Service Mapping MCP tools enforces the sn_sm_gen_ai.sm_mcp_user role. This role is not automatically added to the standard Service Mapping role hierarchy after deployment. You must configure the containment records manually, because role hierarchy assignments cannot be included in a scoped update set.
The following table describes the roles involved and the access each one grants.
| Role | Type | Granted rights |
|---|---|---|
| service_mapping_user | Standard Service Mapping role | Read access to application service maps and topology data. Assigned to end users who query service data via the MCP Server. |
| sn_sm_gen_ai.sm_mcp_user | MCP access role | Enforced by the REST API ACL on all five Service Mapping MCP tools. Users must have this role (directly or via containment) to call the tools. |
| sn_mcp_server.viewer | MCP platform role | Grants the ability to discover and invoke tools on an MCP server. Required by sn_sm_gen_ai.sm_mcp_user. |
| sn_sm_gen_ai.sm_mcp_admin | MCP admin role | Grants elevated access for administering the Service Mapping MCP tools. |
service\_mapping\_user contains sn\_sm\_gen\_ai.sm\_mcp\_user, which contains sn\_mcp\_server.viewer. The sn\_sm\_gen\_ai.sm\_mcp\_admin role separately contains sn\_sm\_gen\_ai.sm\_mcp\_user.
Procedure
Configure the role containment chain.
Navigate to All > User Administration > Roles and open the service_mapping_user role record.
In the Contains Roles related list, add sn_sm_gen_ai.sm_mcp_user.
The service_mapping_user role contains the sn_sm_gen_ai.sm_mcp_user role.
Open the sn_sm_gen_ai.sm_mcp_user role record.
In the Contains Roles related list, add sn_mcp_server.viewer.
Users with the sn_sm_gen_ai.sm_mcp_user role can discover and invoke tools on the Now Assist CMDB MCP Server.
Open the sn_sm_gen_ai.sm_mcp_admin role record.
In the Contains Roles related list, verify that sn_sm_gen_ai.sm_mcp_user is present.
If the role is not present, add it. This ensures that users with the admin role can also call the tools.
Assign the required roles to each end user who needs to query application service data through Claude Desktop.
Navigate to All > User Administration > Users and open the record of a user who needs access to the Service Mapping MCP tools.
Scroll to the Roles related list and select Edit.
Add the service_mapping_user role.
This role inherits sn_sm_gen_ai.sm_mcp_user and sn_mcp_server.viewer through the containment chain you configured in the previous step. All three roles are required for end-to-end tool invocation.
Select Save.
Result
The role hierarchy is configured and users are assigned the required roles. Users assigned the service_mapping_user role can connect an MCP-compatible AI client and call all five Service Mapping MCP tools. Users assigned sn_sm_gen_ai.sm_mcp_admin retain the same tool access plus elevated administrative rights.
What to do next
Activate the CMDB MCP Server for Service Mapping tools
Parent Topic:Service Mapping MCP tools