ServiceNow AI: Now Assist, Agentic Workflows & AI Agents

01Executive summary

ServiceNow's mid-2026 AI portfolio is best understood as three build layers plus a governance plane. Now Assist supplies packaged generative-AI skills (300+ across 30+ modules per partner counts) plus the Now Assist Skill Kit (NASK) for custom skills. AI Agent Studio is the official surface for building, testing, and managing AI agents and agentic workflows, and the AI Agent Orchestrator is the runtime that coordinates teams of agents toward a goal. Interoperability is first-class via AI Agent Fabric — the A2A protocol for agent-to-agent communication (external agents as peers, ServiceNow agents as secondary agents) and MCP for external tools. Governance is anchored by AI Control Tower (asset inventory, risk & compliance, adoption/value, AI Gateway for MCP connections) with agent-level guardrails: deny-by-default ACLs, role masking, Now Assist Guardian content/prompt-injection filtering, and Data Privacy masking.

02What's new since July 2026 New in this edition

Releases and announcements from the July edition up to 31 Oct 2026. It also picks up the Knowledge 2026 and Australia Patch 3 items the first edition left out. "Announced" doesn't mean you can install it, so the Availability column says what state each item is in.

Release and announcement tracker

Model defaults changed (Australia P3)

GPT-5.4 is now the default Orchestrator model for Azure OpenAI, and default third-party models moved from GPT-5.2 to GPT-5.4. Amazon Bedrock adds claude-sonnet-4-6. When the default model changes, agent behavior can change too, so re-run your Agentic Evaluation suite after any patch that moves defaults.

03The AI stack: how the pieces fit

Everything ServiceNow ships under "AI" resolves to one of these layers. Getting the vocabulary right up front prevents most design mistakes later.

Vocabulary that matters

04Use cases by domain

ServiceNow documents three archetypal agentic use-case patterns: resolve tasks, execute routine-but-variable procedures, and investigate root causes or analytical trends. Everything below is an instance of one of these. Per-product Now Assist apps ship from the Store on a faster-than-family cadence, so exact contents vary by installed app version.

ITSM

CSM

HRSD

Creator / custom domain

05Design principles & patterns

Build-level guidance distilled from ServiceNow's own CoE and community engineering articles — the material that separates working agentic implementations from stalled pilots.

5.1 The decision framework: workflow → skill → chain → agent

The single most important architectural decision is where on the determinism spectrum a use case belongs. Agents are the most expensive and least predictable option — they should be the last resort, not the default.

Qualifying questions from the CoE: Do knowledge workers make subjective decisions in this workflow? Do steps vary in order or approach? Can AI safely replicate that judgment with the data available? A worked cost example from the same source: a naïve all-agent design at 26 assists per run was rebuilt as a hybrid (skills + chain + one agent) at 12 assists — a 53% saving for identical outcomes.

5.2 Agent design

• Workflow ≠ agent. The agentic workflow is the end-to-end scenario; agents are modular components doing one task each. Map the whole use case on paper before opening Studio, and keep it to ~10 agents or fewer per use case.
• Role as onboarding. Write the role like you're onboarding a capable new team member unfamiliar with your process ("You are an expert in creating change records…"). A precise role measurably reduces hallucination.
• Proficiency drives routing. The Orchestrator selects agents via AI Search over the Agent Proficiency field. Empty or vague proficiency is the top cause of "No agents available" errors.
• Memory is a design decision. Short-term memory is session-scoped (multi-turn context, inter-agent data sharing); long-term memory persists per user as vectors in sn_aia_memory, with the LLM auto-selecting what to store. Decide STM/LTM boundaries at design time and write explicit recall instructions.
• Planner modes: Base Planner (static one-shot plan — simple linear tasks), ReActive Planner (iterative, conversation-driven — unknown flows and chat), Batch Planner (task grouping with mid-execution replanning — complex parallel subtasks).
• Accept non-determinism. Identical inputs can produce different runs. If that's unacceptable, you wanted a flow or a chain, not an agent.

5.3 Writing instructions that actually execute

• Structure per step: action-oriented name → single objective → required actions (keyword verbs) → explicit completion trigger, plus validation-gate sub-steps with measurable criteria.
• Anchoring: primary anchors at the top (##CRITICAL REQUIREMENT), reinforcement mid-prompt, validation anchors at endpoints. Use "must," not "should." Don't overuse anchors — they drift.
• Quantify everything: "minimum 3 recommendations," not "some suggestions." Explicit if/then conditions with a fallback branch ("IF none apply…"), and require the agent to state TRUE/FALSE per condition with cited evidence.
• Evidence gates for high-stakes decisions: an internal-only reasoning step (premises with source refs → execution trace including branches not taken → conclusion from documented evidence only), anchored "INTERNAL – DO NOT DISPLAY TO USER," with a separate present-to-user step. Prevents phantom premises and reasoning leakage.
• Parallelism control (ReAct): independent autopilot tools batch up to 4. Force batching with "these operations are independent and share no dependencies"; force serialization with "must execute sequentially" / "these write to the same record." Copilot (user-permission) tools and shared-write-target tools always serialize.

5.4 Tool design

• The orchestrator picks tools by Name + Description. Descriptions must state expected input format, output structure, and applicable use cases — this is your real API documentation.
• Granularity tension (resolve per use case): engineering guidance says narrow single-responsibility tools and let the orchestrator chain them; cost guidance says consolidate proven sequences into subflows because billing counts agent actions. Field resolution: design narrow during build/test, consolidate proven sequences into subflows for production.
• Script tools must explicitly return outputs = {...} — gs.info() logging never reaches the agent. Watch for hidden characters (zero-width spaces) breaking downstream logic; .trim() defensively.
• Output transformation strategy: "None" = raw JSON (best for IDs/records passed to the next step); "Verbose" = natural language (best for user-facing output). Per-tool "Display output" controls end-user visibility.
• Search retrieval (RAG) requires indexed sources and a published search profile; prefer Hybrid (semantic + keyword) mode. Unindexed/unpublished sources are a silent failure mode.
• Loop protection: sn_aia.continuous_tool_execution_limit caps repeated executions of the same tool — hitting it surfaces as "the agent states it can no longer execute a tool."
• Prefer Flow Designer actions over scripts, per ServiceNow's own platform best practice.

5.5 Triggers & orchestration mechanics

• Triggers are optional — omit one and the workflow simply appears in the Now Assist Panel. When you do define one, specify type (Created / Updated / Created-or-updated), table, conditions, run-as user, and an objective template (e.g., Help me resolve ${number}).
• Recursion gotcha: an "Updated"-triggered workflow that itself updates the same table re-triggers itself. Prevent with granular exclusion conditions.
• Triggered runs execute as the run-as user and land in that user's chat history; supervised tools in a triggered flow wait for the run-as user's input. Database-triggered agents don't automatically post output to the record form.
• UI Actions, Scheduled Jobs, and Business Rules can update records to indirectly trigger agents; keep state in custom tables for that pattern — and do the governance/cost analysis first.

5.6 Human-in-the-loop

The supervised/autonomous switch lives at the tool level in AI Agent Studio: Supervised = the user approves before that tool executes (e.g., approve "Create Change Request"); Autonomous = executes without asking. The overall model is "human on the loop" — monitor and intervene — with agents able to present plans for approval before execution. In Agentic Playbooks the same idea appears as helper agents (confirm at decision points) vs worker agents (autonomous). Reserve full autonomy for low-blast-radius actions; in regulated industries, HITL on any consequential action is the documented norm.

5.7 Testing & evaluation

• Studio Testing tab: run a workflow or single agent against a task, watch the output pane, expand AI decision logs, export as reports.
• Agentic Evaluation tool: run 20–100 representative historical records; scores task completeness, tool-calling correctness, and faithfulness. NASK has the equivalent (AI-as-judge Faithfulness/Correctness metrics, grounded-prompt inspection, token-consumption view).
• Debug tables: sn_aia_execution_plan (agent order), sn_aia_execution_task, sn_aia_message, sn_aia_tools_execution, sys_gen_ai_log_metadata.
• Triage cheatsheet: output invisible to requester → requester lacks table/field ACLs. "No agents available" → proficiency field, AI Search enabled, 128K token ceiling, active status. Panel timeout → com.glide.cs.conversation_idle_timeout (default 2h).
• Testing consumes real assists — budget for it, and beware cloned sub-prod instances burning the production pool (KB2558225).

06Governance, licensing & limits

What platform owners must control: consumption economics, model/data governance, guardrails, and the hard technical limits builders will hit.

6.1 Licensing & the assists consumption model

An assist is the contractual unit metering Now Assist usage per performed skill action. Usage aggregates daily, pools at the account (tenant) level, and resets annually on the purchase anniversary; overage can be invoiced. The authoritative document is the Now Assist Overview legal PDF (effective 20 Jan 2026).

Key mechanics: a workflow run is metered as one bundled event sized by action count — skills and VA topics executed as tools inside it do not consume separately; orchestrator/communicator actions are excluded from the count; Guardian-blocked content and LLM errors consume nothing.

Consumption reality check (advisory-firm estimates, directional)

100 actively-adopting ITSM fulfillers typically burn 40,000–80,000 assists/month — exhausting a nominal annual allocation in 6–9 months; heavy use burns ~12× faster than light use. The biggest silent consumers are background automation: Virtual Agent fallback routing into Now Assist, workspace auto-summarization, custom Skill Kit skills, and testing on cloned sub-prod instances (which draws from the same pool). Negotiation levers practitioners emphasize: pre-negotiate the overage/top-up rate before signing ("left unset, it gets set when the first overage lands"), assist rollover clauses, written per-action rates, and adoption gates.

6.2 Now LLM vs BYO-LLM

Configuration note (a claim the verification pass refuted twice): BYO-LLM mechanics live in the Generative AI Controller and Now Assist Admin Settings — AI Control Tower surfaces and governs model choice (restricting to approved providers) but is not the configuration mechanism itself.

Data privacy posture: data-sharing for ServiceNow product improvement is opt-out (Now Assist Admin console → Settings), and only masked/anonymized prompts are used where enabled. With external LLMs, your data does transit to the third-party provider — review that provider's terms; the Sensitive Data Handler / Data Privacy masking can anonymize before send. Regional inference and burst-overflow processing (to Azure public cloud, claimed region-preserving) are described in partner summaries of login-gated KB2689562 — verify residency and retention specifics against that KB with your account team.

6.3 Guardrails

6.4 AI Control Tower & AI Gateway

AI Control Tower is the governance hub for AI of any origin: unified asset inventory in the CMDB (AI systems, models, prompts, datasets, MCP servers) with lifecycle tracking intake→retirement; discovery integrations for AWS Bedrock and Azure AI Foundry (expanding to Databricks, Snowflake, Hugging Face via Service Graph connectors); risk scoring with built-in EU AI Act and NIST AI RMF support (2026 adds compliance content packs for EU AI Act and California/Colorado AI Acts); detection of dormant or over-privileged agents; per-team quotas and a kill switch; and value/ROI dashboards. Routine skill administration stays in the Now Assist Admin console.

AI Gateway (GA Dec 2025; Zurich Patch 4+ with AI Control Tower Core 6.1.0+) centrally governs all MCP server connections across agent platforms — ServiceNow, Microsoft Copilot Studio, Bedrock, Vertex, custom. OAuth 2.1 enforced ("no path to an MCP server that bypasses authentication"), PII detection via the PII Vault service before data reaches downstream systems, instant pause of any/all MCP servers (≤10-min cache TTL), full audit trails, and builder restriction to approved servers. Limits: remote-hosted MCP servers only; API-key-auth servers don't get full proxy enforcement.

Sep 2026 The rebuilt AI Gateway (GA 10 Sep 2026) runs on an Envoy data plane. It adds a single MCP tool catalog that blocks unapproved servers at build time and passes tool-level policies down to agents. Tools are scanned for malicious instructions before deployment and for sensitive data at runtime, and a flagged tool stays blocked until a steward reviews it. Tokens are short-lived and scoped, and you can see success rate and latency per server, tool and client.

6.5 Platform limits (the numbers builders hit)

07AI security New in this edition

Section 06 covers governance: who may use AI, at what cost, and under which policy. This section covers the attacker's view: how a ServiceNow agent gets abused, which disclosed issues have already shown it, and the controls and settings that close each path.

7.1 Threat model for ServiceNow agents

Agents act with real privileges on the system of record, so the risk is less about what the model says and more about what the agent is allowed to do. The table maps each threat to the OWASP Top 10 for LLM Applications (2025) categories and the platform controls that address it.

7.2 Disclosed issues every architect should know

7.3 Agent identity: who the agent acts as

• Tool ACLs are checked at runtime against the run-as identity. Missing roles show up as failures or empty results, which often get misread as "the agent is broken".
• AI Agent Studio requires a role-based access policy before a configuration can be saved. Australia P3 makes AI objects deny-by-default on newly activated instances. Upgraded instances don't get this automatically, so audit them.
• Script tools: use GlideRecordSecure, not GlideRecord, and always pass the user's session context. Otherwise the engine can evaluate the query as admin. For KB articles and catalog items, also check User Criteria, because UI ACLs alone don't stop background context engines.
• Community pattern global.AIAgentAccessValidator (validateAgentContext(userId, table, sysId)): useful, but the published version logs and continues when the User Criteria check throws, so it can still return true. Make that path return false.
• Where this is heading: Veza agent maps in AICT 2.0 already flag privileged or dormant agents and their human owners. AI Passport (Q4 2026) moves enforcement to every action with signed credentials. In ServiceNow's demo, a refund agent with a $25 limit approved $18 and sent $40 to a human.

7.4 Defense in depth across the agent lifecycle

7.5 Hardening checklist

In priority order. Each item is a setting or practice you can verify on an instance today.

1. Verify patch levels for sn_aia and sn_va_as_service at or above the BodySnatcher fix versions, and track Store app versions every patch cycle.
2. Set every tool that writes, sends or deletes to Supervised unless the blast radius is trivial. Disable sn_aia.enable_usecase_tool_execution_mode_override so use cases can't quietly override that.
3. Segment agent teams and limit discoverability. An agent that reads untrusted text (emails, portal input, external records) shouldn't be on the same team as one that can modify privileged data.
4. Default to Dynamic User. Allow an AI User only with minimum roles, role masking, a named owner and a written reason. Review them quarterly with the AICT Veza view.
5. Turn on Data Privacy masking and the Sensitive Data Handler before routing any skill or agent to an external LLM. Masking is off by default.
6. Enable the Guardian prompt-injection guardrail and measure false positives on real traffic before you rely on it. Remember it didn't stop the second-order attack.
7. Route all MCP through AI Gateway. Block unapproved servers, prefer OAuth over API-key servers (they don't get full proxy enforcement), and rehearse a pause/restore.
8. Harden script tools: GlideRecordSecure, session context, User Criteria checks, sanitized outputs, and a fail-closed validator.
9. Keep an adversarial test suite: injected text in records and KBs, cross-role requests, and attempts to recruit other agents. Re-run it after every patch and every default-model change.
10. Rehearse the kill switch. Set runaway thresholds, decide who may pull it, and time containment end to end, from detection to revoked credentials.

7.6 Regulatory frame for APAC deployments

Singapore's IMDA launched the Model AI Governance Framework for Agentic AI on 22 Jan 2026 at WEF. It's guidance with four dimensions, and each maps to a platform control:

Control Tower ships NIST AI RMF and EU AI Act frameworks. An IMDA mapping is not listed as out-of-the-box, so build it as a custom framework in AICT risk and compliance.

08Tips, gotchas & best practices

The field-tested list — what ServiceNow's own CoE, Now-on-Now, and practitioner articles say actually goes wrong, and what works.

8.1 Gotchas (ranked by how often they bite)

8.2 Cost governance (run it like FinOps)

• Model consumption per skill before go-live; phase rollout from low-complexity, high-value skills; monitor weekly during rollout, monthly at steady state; quarterly audits to disable unused skills.
• Instrument: Now Assist Analytics (~8 dashboards incl. Usage & Adoption, Skill Performance, Guardian), Subscription Management (purchased/used/available assists with per-skill breakdown), and raw tables sys_gen_ai_usage_log and sn_aia_execution_plan for granular attribution. Distinguish actions (counts) from assists (weighted consumption).
• Assign a named owner, set alert thresholds before pool exhaustion, and use AI Control Tower per-team quotas + kill switch.
• Data quality is a cost lever: a stale CMDB/weak CSDM causes agent retries and escalations that consume extra assists — "a direct line to the bill."
• Design for cost: hybrid architectures (skills + chains + one agent) over all-agent designs; consolidate proven tool sequences into subflows; remember small/medium/large workflow banding — an 8-action workflow costs half a 9-action one.

8.3 Adoption playbook (CoE four-phase pattern)

• Sequencing principle: skills are the building blocks; chains next; agents last. The failure statistics motivating this: ~50% of agentic projects stall in pilot, and the gap is people/governance — not data or technology.
• Roles to provision: now_assist_panel_user, sn_skill_builder.admin, now.assist.creator, sn_aia.admin. Team skills: Flow Designer, prompt engineering, platform architecture, AI Search/RAG.
• EMEA specifics: Works Council engagement from day one, early DPIA, data sovereignty via regional hosting/BYO-LLM.
• Change management beats features: manager advocacy, a top-5 power-user champion program, and visible quick wins drive the adoption curve.
• Success benchmarks used by ServiceNow's own materials: >70% autonomous completion, 30–50% MTTR reduction, +20pt satisfaction, zero compliance breaches.

09Confidence notes & open questions

The July edition was produced by an adversarial-verification pipeline (25 sources fetched, 123 claims extracted, top 25 put to a 3-vote refutation panel: 23 confirmed, 2 refuted) plus four targeted follow-up research passes. Honesty about what's solid and what isn't:

• Refuted twice and corrected here: "AI Control Tower is the mechanism for configuring BYO-LLM." It isn't — configuration lives in the Generative AI Controller / Now Assist Admin Settings; Control Tower governs and surfaces.
• Vendor-primary sourcing: capability descriptions are well-served by servicenow.com docs, but positioning lines ("agent teams outperform single agents," "central hub") are vendor framing without independent benchmarks.
• 2-1 verification votes: the "six ITSM agentic workflows" count and the Zurich P11 change-risk skill details — evidence was strong but treat exact counts as editorial gloss on a moving target.
• Third-party only (verify with your account team): all dollar pricing and per-tier assist pool figures; the April 2026 Foundation/Advanced/Prime restructure dates (well-corroborated but no first-party press release fetched); Now LLM regional-inference/retention specifics (login-gated KB2689562); the "30-day wait before data collection" claim; the per-skill provider matrix (KB2222333).
• Time sensitivity is acute: features ship and deprecate at patch level. The July content was verified as of 17 Jul 2026; sections 02 and 07 as of 31 Oct 2026.
• October 2026 update, announced vs shipped: AI Passport, shadow AI detection, AI Cost Management, Brazil GA, Flow GA and the OpenAI security capabilities are forward-looking as of this update. Dates come from press releases and may slip.
• October 2026 update, source quality: security incidents (CVE-2025-12420, second-order injection) come from AppOmni's disclosure as reported by The Hacker News. Brazil Studio redesign, Agent Advisor and Test Agent come from partner previews, not release notes. The MCP-server benchmark and Veza's "30 billion permissions" are vendor figures. The "Super Intelligence Control Tower" rename appears only in October press releases so far.

10Sources

Official documentation & legal

• AI Agent Studio — product docs · AI Agents product page · AI Agent Fabric
• Zurich intelligent-experiences docs (agentic workflows, security guardrails) · ACLs & role masking
• Now Assist for ITSM — Zurich release notes · Now Assist for CSM · Now Assist for HRSD — Zurich release notes
• Now Assist for ITOM · Now Assist AI agents for SIR · Now Assist for Creator
• AI Control Tower — configuring AI governance · AI asset inventory · AI Gateway overview
• BYOK for Azure OpenAI · Providers and models
• Now Assist Overview (legal PDF, assists rate card, eff. Jan 2026) · Now Assist for ITSM data sheet · Now-on-Now implementation white paper

ServiceNow Community (product-team & CoE articles)

• Advanced AI Agent Instructions Guide · AI Agent Tools · Practical Implementation: Lessons from the Field
• When to Use AI Agents · Building and Scaling AI Agents · Getting Started with Agentic Workflows
• AI Agents FAQ & Troubleshooting · Skill Kit (NASK) FAQ · Generative AI Controller FAQ
• Now Assist Guardian FAQ · Data Privacy for GenAI · Using External LLMs (BYOK/BYOLLM) · Model Provider Flexibility
• AI Gateway FAQ · AI Control Tower in Zurich (GRC blog) · AI Control Tower — June 2026 release
• Agentic AI Adoption Playbook · Gotchas & Leading Practices · Tracking Now Assist Usage & ROI
• Agentic AI capabilities for HR · ITOM AI agents · SecOps team of agents · Now Assist for Creator — Zurich
• Zurich release kickstart guide · AI-native licensing in 2026 (practitioner guide)

Added in the 31 Oct 2026 update

• Now Assist AI Agents release notes (Australia P1–P3) · Agentic AI security and governance (docs) · Securing AI agent identities in Now Assist (community)
• What's new in AI Control Tower, Aug & Sep 2026 · Out-of-the-box MCP servers · Top features in Brazil release, Part 1
• Autonomous Security & Risk (press release, 5 May) · Flow by ServiceNow (1 Oct) · AI Workflow Factory (6 Oct)
• Control Tower Alliance (28 Oct) · ServiceNow and OpenAI (28 Oct)
• The Hacker News: BodySnatcher, CVE-2025-12420 · The Hacker News: second-order prompt injection · Tech Times: AI Passport
• The Register: agent kill switches · Reworked: Action Fabric and Control Tower · NowSpectrum: Knowledge 2026 recap · Binmile: Brazil release preview
• Baker McKenzie: Singapore Model AI Governance Framework for Agentic AI

Third-party / analyst (pricing & skeptical takes, treat as estimates)

• Redress Compliance — Now Assist licensing · Crossfuze — 2026 pricing changes · Teiva Systems — consumption guide · Teiva — skills/agents/workflows guide
• CIO.com — Zurich agentic AI · Crossfuze — Now Assist FAQs (residency) · jace.pro — new AI pricing tiers