Disable Adding Default Roles to Skill ACLs
Use system properties to control what roles are automatically added to generative AI skill ACLs.
Use the com.glide.one_extend.include_default_roles_for_skill_acl system property to control whether roles are automatically added to generative AI skill ACLs when they’re created or updated via the global.GenAiSkilSecurityUtils API. This property is used by the Now Assist Skill Kit (NASK) to enforce consistent security policies across all AI skills.
When a skill ACL is inserted or updated, the default roles defined in the com.glide.one_extend.default_roles_for_skill_acl system property are automatically included. This addition ensures that certain privileged roles always have access to execute the skills. The com.glide.one_extend.default_roles_for_skill_acl property may contain a comma-separated list of roles.
Ensure that the com.glide.one_extend.include_default_roles_for_skill_acl is set to false, or that the property doesn't exist on the System Properties [sys_properties] table.
More information
| Attribute | Description |
|---|---|
| Configuration name | com.glide.one_extend.include_default_roles_for_skill_acl |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | Boolean |
| Recommended value | false |
| Default value | false |
| Fallback value | false |
| Category | Access control |
| Security risk | - Severity score: 4.2 - CVSS score: Medium - Security risk details: Roles are automatically added to Generative AI Skill ACLs when this feature is enabled. Depending on the role, this may allow overly broad access to certain skills and override intended ACL behavior. |
| Functional impact | Certain roles may be prevented from using skills if they don’t satisfy an existing access control. These two property configurations ensure certain roles retain a base level of access to all skills. |
| Dependencies and prerequisites | None |
Parent Topic:Access control