--- schema_version: "1" id: a51033c320415d92d59c56fd10db3215e0152204ce2647695f68ab5cc7feec9f title: Service Assistant Grounding Data Access collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/sp_ground_data.md canonical_url: https://help.salesforce.com/s/articleView?id=service.sp_ground_data.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 0ac8f5fa8aab0f7975faf95b0cdcbc97fdc23cf190c903b57ab538eadd52077f description: Service plans are generated using the permissions of the ServicePlanner User (the agent user), which has a broader scope of grounding source data access to provide the most comprehensive service plans. This access supersedes any individual field-level security or sharing rules for service reps. The information in this section describes how the ServicePlanner User's permissions govern data access for each grounding source. We recommend configuring the ServicePlanner User's permissions to align with the data access and sharing rules required for your service reps. products: - Service Cloud - Service Intelligence release: "264" --- # Service Assistant Grounding Data Access Service plans are generated using the permissions of the ServicePlanner User (the agent user), which has a broader scope of grounding source data access to provide the most comprehensive service plans. This access supersedes any individual field-level security or sharing rules for service reps. The information in this section describes how the ServicePlanner User's permissions govern data access for each grounding source. We recommend configuring the ServicePlanner User's permissions to align with the data access and sharing rules required for your service reps. ### Required Editions
View supported editions.
Checkmark This article applies to: Service Assistant for Case, Messaging, and Voice.
- [Service Plan User Context](https://help.salesforce.com/s/articleView?id=service.sp_ground_data.htm&release=264.0.0&type=5) - [Case Grounding Data Access](https://help.salesforce.com/s/articleView?id=service.sp_ground_data.htm&release=264.0.0&type=5) - [Messaging Session Grounding Data Access](https://help.salesforce.com/s/articleView?id=service.sp_ground_data.htm&release=264.0.0&type=5) - [Knowledge Grounding Data Access](https://help.salesforce.com/s/articleView?id=service.sp_ground_data.htm&release=264.0.0&type=5) - [Agent Actions Data Access](https://help.salesforce.com/s/articleView?id=service.sp_ground_data.htm&release=264.0.0&type=5) - [Related Records](https://help.salesforce.com/s/articleView?id=service.sp_ground_data.htm&release=264.0.0&type=5) - [Similar Cases Data Access (Service Assistant for Case Only)](https://help.salesforce.com/s/articleView?id=service.sp_ground_data.htm&release=264.0.0&type=5) - [System Controls and Security](https://help.salesforce.com/s/articleView?id=service.sp_ground_data.htm&release=264.0.0&type=5) ## Service Plan User Context Service Assistant is designed to provide the most comprehensive case resolution. Therefore, the plan's grounding sources reference the ServicePlanner User's permissions, which has a broader scope of data access than that of individual service reps. This means that: - The service plan provides the most comprehensive resolution guidance by using all data that is accessible to the ServicePlanner User. This data access supersedes the more restricted permissions held by the service rep. - The content of a service plan doesn't change based on the specific field-level security or sharing rules of the service rep. As a best practice, we recommend configuring the ServicePlanner User's permissions and field-level security to match those of your service reps. The following sections clarify how the ServicePlanner User's permissions determine the scope of data access for each grounding source. ## Case Grounding Data Access Through Service AI Grounding, you select the case data that Service Assistant accesses to create a case summary, categorize the case with a topic, and generate initial steps. The case fields and objects (Case Emails, Case Feed, Case Comments) that you select are always referenced as a grounding source. The ServicePlanner User includes this data in the plan regardless of a service rep's specific restrictions. As a result, the information included in a drafted service plan is accessible to service reps even if they don't have access to those specific fields and objects. Since the agent users' permissions determine service rep data visibility, we recommend only including fields and objects in your Service AI Grounding that you want visible in the final plan. The ServicePlanner User is authorized to access all configured fields for grounding, which ensures that the plan is accurate but may expose data that's not intended for all service reps. Keep in mind that if you choose to ground on Case Emails and Case Comments, the ServicePlanner User has access to the objects by default. If you choose ground on Case Feed, you must grant the ServicePlanner User access to the Case Feed. Find more information about the feature and considerations in [Grounding Sources](https://help.salesforce.com/s/articleView?id=service.sp_blocks_intro.htm&type=5&language=en_US) and [Service AI Grounding](https://help.salesforce.com/s/articleView?id=service.einstein_generative_ai_ground_cases.htm&type=5&language=en_US). ## Messaging Session Grounding Data Access For Service Assistant for Messaging, the grounding source is the messaging session transcript. Service Assistant grounds the plan in the entire conversation using the ServicePlanner User's permissions, so it reads the transcript regardless of a service rep's specific restrictions. As a result, the plan reflects the full conversation. To generate service plans for messaging sessions, the ServicePlanner User requires a custom permission set that grants Read and View All Fields on the Messaging Session object and the Access Conversations Entries app permission. Service reps require the Messaging Eligibility Flow Access custom permission set so that the eligibility criteria flow runs when the record page opens. The flow doesn’t run under the ServicePlanner User’s Run Flows permssions. Find more details in these articles. - [Eligiblity Criteria](https://help.salesforce.com/s/articleView?id=service.sp_eligibility_reference.htm&language=en_US&type=5) - [Messaging Permissions](https://help.salesforce.com/s/articleView?id=service.sp_permissions_messaging.htm&type=5&language=en_US) - [Set Up Service Assistant for Messaging](https://help.salesforce.com/s/articleView?id=service.sp_setup_msg.htm&type=5&language=en_US). In addition, Service Assistant is active only when the messaging session record is owned by human user. If the record is owned by any other user like a bot or a queue, Service Assistant doesn't process the record or generate a plan. ## Knowledge Grounding Data Access The ServicePlanner User requires the Agent Knowledge Access custom permission set to search for, access, and include knowledge information in a service plan. See the knowledge permissions section in [Service Assistant Permissions](https://help.salesforce.com/s/articleView?id=service.sp_permissions.htm&language=en_US&type=5). Because the custom permission set provides broad access to your knowledge base, the plan steps may include information from articles that service reps can't normally access. To align knowledge access between service reps and the ServicePlanner User, service reps require the Service Rep Knowledge Access custom permission set. The permission set includes Read, View All Records, View All Fields, and Allow View Knowledge permissions to grant service reps access to view the step-level knowledge citations and the list of knowledge articles in the Sources section. However, you can modify the customer permission set to align with your organization's security standards. When service reps lack the required permissions to view certain articles, the step-level citation and the link in the Sources section aren't shown. Even when the service rep lacks knowledge access, the plan steps themselves remain grounded in your knowledge articles because the ServicePlanner User has full access. See [Grounding with Knowledge](https://help.salesforce.com/s/articleView?id=service.sp_knowled_topics.htm&language=en_US&type=5) and [Best Practices for Knowledge Grounding.](https://help.salesforce.com/s/articleView?id=service.sp_knowledge_practices.htm&language=en_US&type=5) ## Agent Actions Data Access Agent actions run in the context of the ServicePlanner User, not the service rep. When an action queries or updates records, it uses the ServicePlanner User's permissions, so it can reach data beyond what Service AI Grounding includes, such as fields on the current record or a related account or contact. As a result, plan steps built from actions can surface information that a service rep can't normally access. Grant the ServicePlanner User the permissions that your actions require, including Apex class access, object permissions, and field-level security on each field the action reads. Apex classes that run without sharing return the fullest results, while classes that enforce sharing can return no records without an error. Because actions run with these broader permissions, follow the principle of least privilege and grant only the access your actions need. See [Action Permissions](https://help.salesforce.com/s/articleView?id=service.sp_actions_permissions.htm&type=5&language=en_US) and [Grounding Service Assistant with Agent Actions](https://help.salesforce.com/s/articleView?id=service.sp_actions.htm&type=5&language=en_US). ## Related Records (Service Assistant for Case Only) Service Assistant for Case supports grounding cases in related voice call and messaging session records. When grounding related records, Service Assistant reviews the transcripts to ensure that: - The service plan summary informs the service rep of what took place in messaging or voice call conversation. - The plan's steps start from where the conversation ended, providing a clear handoff from the conversation to the case. For this feature, the ServicePlanner User requires the Conversation Grounding Access custom permission set with app and object permissions to messaging sessions and voice calls. The permission set grants Service Assistant object-level access to read transcripts attached to the case and incorporate that information into the plan. Service reps don't require additional permissions to view record information in service plans. This means that the ServicePlanner User's permissions determine all data included in the plan and service reps can view messaging or voice conversation data even if they don't have access to the Messaging Session or Voice Call objects. We don't recommend modifying the ServicePlanner User's custom permission set since all permissions are required to use the feature. However, opening and viewing the messaging or voice record attached to the case still adheres to your company's sharing rules. Service reps require record-level access to open and view the original record. See [Grounding with Related Records](https://help.salesforce.com/s/articleView?language=en_US&id=service.sp_mvg.htm&type=5). ## Similar Cases Data Access (Service Assistant for Case Only) You can provide service reps a list of similar cases in the service plan to provide service reps a way to review how previous cases were resolved. See [Set Up Similar Cases](https://help.salesforce.com/s/articleView?id=service.sp_sc_ov.htm&type=5&language=en_US). The similar cases aren't used as a grounding source to create the steps of the service plan. However, the ServicePlanner User still requires the Data 360 User permission set to search for and include the list of similar cases in the service plan. The list of similar cases respects your company's sharing rules. Service reps require record-level access to open and view the listed similar cases. ## System Controls and Security To limit service reps' access to information you don't want them to see, we recommend following the principle of least privilege when configuring each grounding source and its permissions. Configure the ServicePlanner User's permissions to align with the data access and sharing rules required for your service reps. - Limit your Service AI Grounding configuration to fields that you want visible in the final plan. The ServicePlanner User is authorized to access all configured fields for grounding, which ensures the plan is accurate but may expose data not intended for all service reps. - All grounding data passes through the [Einstein Trust Layer](https://help.salesforce.com/s/articleView?id=ai.generative_ai_trust_arch.htm&language=en_US). This layer is configurable and gives you granular control over data masking to make sure that sensitive information is protected during plan creation. [See Set up Einstein Trust Layer](https://help.salesforce.com/s/articleView?id=ai.generative_ai_trust_setup.htm&type=5&language=en_US). - The custom permissions for Knowledge grounding are configurable to the security standards of your organization. - The custom permissions for Messaging Session and Voice Call record grounding can't be modified. If service plans include related Messaging Session or Voice Call records and the grounding feature is turned on, service reps are able to view the conversation data in the service plan even without object-level access to the records. Therefore, you must determine if this conversation visibility is acceptable. If not, don't turn on the feature. #### See Also - [_Salesforce Help_: Permissions and Licensing for Service Assistant](https://help.salesforce.com/s/articleView?id=service.sp_permissions&language=en_US) - [_Salesforce Help_: Service Assistant Grounding Sources](https://help.salesforce.com/s/articleView?id=service.sp_blocks_intro&language=en_US) - [_Salesforce Help_: Best Practices for Agent User Permissions](https://help.salesforce.com/s/articleView?id=ai.agent_user.htm&language=en_US)