ServiceNow Otto for Vault lets you classify, encrypt, and govern access to sensitive data through AI skills and agentic workflows built into the Vault console. It proposes data classes for columns and custom apps, generates data patterns from plain language, and encrypts fields with the access policies each role needs.

1. Generate a custom data pattern — creates a custom regular expression data pattern from your description and adds it as an active data pattern
2. Check role access for an encrypted column — identifies the user roles that have access to encryption and decryption keys in your instance
3. Schedule a data discovery job — schedules one-time or recurring data discovery jobs to detect sensitive data such as PII or PHI
4. Securing custom apps with Vault agents — proposes data classifications and available protections for a custom application
5. Field encryption and auto-generate access policies — encrypts a table field and creates a module access policy for each role that needs access to it
6. Field encryption with Vault module — encrypts specific fields and configures secure access for users with designated roles
7. Access observer configuration — views, creates, deactivates, and deletes Access Observer settings for a particular field
8. Summarize access observer logs — reviews and summarizes access logs for a specific field, identifying access sources, users, and their roles