OWASP Agentic AI Top 10 Applied to ServiceNow

The Agentic AI Top 10 maps onto ServiceNow more directly than the LLM Top 10 does, because Now Assist agents do not merely generate text — they act, using an identity of their own. Read it as a checklist of what an autonomous agent can do wrong on your instance: exceed its authority, be steered by content it reads, chain into other agents, or accumulate permissions nobody is tracking. The recurring root cause is non-human identity management, which most organisations have not yet extended to agents at all.

What This Is

The OWASP Top 10 for Agentic Applications (ASI01:2026 -- ASI10:2026), published December 2025 by over 100 industry experts, identifies the most critical security risks facing autonomous and agentic AI systems. Unlike the OWASP LLM Top 10 (which focuses on risks from single-model content generation), the Agentic AI Top 10 addresses the far greater risks that come from autonomous action -- when AI agents can act independently, accessing APIs, modifying databases, executing workflows, and delegating to other agents.

ServiceNow's Zurich release (2025-2026) makes agentic AI a core operating model with AI Agent Fabric, Agent Builder, and AI Control Tower. This article maps each official OWASP Agentic AI risk to specific ServiceNow vulnerabilities, configurations, and mitigation controls.

OWASP Top 10 for Agentic Applications (2026) -- Official List

ServiceNow's Agentic AI Architecture

ServiceNow's AI Agent Fabric unifies multiple AI agent types:

Why This Is Dangerous

ASI01: Agent Goal Hijack -- ServiceNow Context

Risk: An attacker manipulates AI agent objectives through prompt injection embedded in ServiceNow records (incidents, knowledge articles, CMDB CIs) or through agent-to-agent discovery exploitation. The agent pursues attacker-defined goals instead of its intended purpose.

Real-world precedent: EchoLeak -- hidden prompts turned AI copilots into silent data exfiltration engines.

ServiceNow-specific manifestation:

// Detect records that could contain goal hijacking instructions
var tables = ['incident', 'kb_knowledge', 'change_request', 'sc_req_item'];
var hijackPatterns = [
    'descriptionLIKEignore your instructions',
    'descriptionLIKEyour new objective',
    'descriptionLIKEsystem instruction',
    'descriptionLIKEoverride your purpose',
    'descriptionLIKEforget everything'
];

tables.forEach(function(table) {
    var gr = new GlideRecord(table);
    if (!gr.isValid()) return;
    gr.addEncodedQuery(hijackPatterns.join('^OR'));
    gr.addQuery('sys_created_on', '>=', gs.monthsAgo(3));
    gr.setLimit(5);
    gr.query();
    if (gr.getRowCount() > 0) {
        gs.info('[ASI01] ' + table + ': ' + gr.getRowCount() +
            ' records with potential goal hijacking patterns');
    }
});

ServiceNow controls:

• Now Assist Guardian prompt injection detection (Block and Log mode)
• Input sanitization for fields processed by AI agents
• Agent team segmentation to limit cross-agent goal propagation

ASI02: Tool Misuse and Exploitation -- ServiceNow Context

Risk: Agents use legitimate ServiceNow tools (GlideRecord operations, REST API calls, workflow triggers) for unauthorized purposes: exfiltrating data, deleting records, or creating persistent backdoors. The agent has valid permissions but is manipulated into weaponizing them.

Real-world precedent: Amazon Q bending legitimate development tools into destructive outputs.

ServiceNow-specific manifestation:

// The Record Management AI Agent can be weaponized to:
// 1. Create admin accounts
// 2. Delete audit records
// 3. Modify ACLs
// 4. Create outbound REST messages for exfiltration

// Detect tool misuse by monitoring agent-created records
var agentRecords = new GlideRecord('sys_audit');
agentRecords.addQuery('sys_created_on', '>=', gs.daysAgo(7));
agentRecords.addEncodedQuery(
    'tablenameLIKEsys_user^OR' +
    'tablenameLIKEsys_user_has_role^OR' +
    'tablenameLIKEsys_security_acl^OR' +
    'tablenameLIKEsys_properties'
);
agentRecords.query();
while (agentRecords.next()) {
    // Check if the modification was made through an AI agent context
    var source = agentRecords.getValue('source') || '';
    if (source.indexOf('agent') > -1 || source.indexOf('now_assist') > -1) {
        gs.info('[ASI02] Agent-modified sensitive record: ' +
            agentRecords.getValue('tablename') + '.' +
            agentRecords.getValue('fieldname') +
            ' | By: ' + agentRecords.getValue('user'));
    }
}

ServiceNow controls:

• Restrict AI agent tool access to specific tables (whitelist approach)
• Block AI agent writes to security-sensitive tables (sys_user, sys_user_has_role, sys_security_acl, sys_properties)
• Supervised execution mode for all write operations

ASI03: Identity and Privilege Abuse -- ServiceNow Context

Risk: Delegated authority, ambiguous agent identity, or trust assumptions lead to unauthorized actions. An attacker impersonates an agent identity, exploits shared credentials, or leverages accumulated privileges. CVE-2025-12420 (BodySnatcher) is the defining example -- a hardcoded platform-wide bearer token enabled unauthenticated identity impersonation across all ServiceNow instances.

Real-world precedent: BodySnatcher (CVE-2025-12420) -- leaked credentials enabling operations beyond intended scope.

ServiceNow-specific manifestation:

// Audit AI-related service accounts for excessive privileges
// and check for shared/hardcoded credentials
var aiAccounts = new GlideRecord('sys_user');
aiAccounts.addEncodedQuery(
    'user_nameLIKEsn_aia^ORuser_nameLIKEsn_va^OR' +
    'user_nameLIKEnow_assist^ORuser_nameLIKEagent'
);
aiAccounts.addQuery('active', true);
aiAccounts.query();
while (aiAccounts.next()) {
    var roles = new GlideRecord('sys_user_has_role');
    roles.addQuery('user', aiAccounts.getUniqueValue());
    roles.query();
    var adminRole = false;
    var roleNames = [];
    while (roles.next()) {
        roleNames.push(roles.getDisplayValue('role'));
        if (roles.getDisplayValue('role') === 'admin' ||
            roles.getDisplayValue('role') === 'security_admin') {
            adminRole = true;
        }
    }
    if (adminRole) {
        gs.info('[ASI03 CRITICAL] AI account ' +
            aiAccounts.getValue('user_name') +
            ' has admin/security_admin role');
    }
    if (roleNames.length > 5) {
        gs.info('[ASI03 HIGH] AI account ' +
            aiAccounts.getValue('user_name') +
            ' has ' + roleNames.length + ' roles: ' +
            roleNames.join(', '));
    }
}

// Check for OAuth applications with shared credentials
var oauthApps = new GlideRecord('oauth_entity');
if (oauthApps.isValid()) {
    oauthApps.addQuery('active', true);
    oauthApps.query();
    while (oauthApps.next()) {
        gs.info('[ASI03] OAuth App: ' + oauthApps.getValue('name') +
            ' | Type: ' + oauthApps.getValue('type') +
            ' | Created: ' + oauthApps.getValue('sys_created_on'));
    }
}

ServiceNow controls:

• Unique per-instance credentials (not hardcoded platform-wide secrets)
• Runtime authorization with short-lived tokens
• Dedicated AI User accounts with least-privilege roles (not Dynamic User)
• Machine Identity Console for NHI visibility and Machine Identity ACLs
• Quarterly privilege reviews for all AI service accounts
• Rapid access interruption capability for agent identities

ASI04: Agentic Supply Chain Vulnerabilities -- ServiceNow Context

Risk: External agents, tools, schemas, or prompts that ServiceNow agents dynamically trust or import at runtime become compromised. Dynamic MCP (Model Context Protocol) and A2A (Agent2Agent) ecosystems are particularly susceptible -- a poisoned MCP server or malicious external agent connected via AI Agent Fabric can inject capabilities that bypass internal security controls.

Real-world precedent: GitHub MCP exploit -- malicious MCP server injecting unauthorized tool capabilities.

ServiceNow-specific manifestation:

• MCP server intake: AI Agent Fabric connects to external MCP servers for tool/data access. A compromised MCP server can serve poisoned tool schemas that cause agents to execute unintended operations
• A2A protocol: External agents connected via AI Agent Fabric operate as secondary agents with delegated trust. A compromised external agent can issue requests that internal agents execute
• Agent Builder marketplace: Third-party agent templates or tools imported into Agent Builder may contain hidden capabilities or backdoors
• Now LLM vs. external models: Agents configured to use external LLM providers (Azure OpenAI, AWS Bedrock) depend on those providers' security posture

ServiceNow controls (Zurich Q1 2026):

• Enforced approval mandates for MCP servers in Agent Studio
• Automated client registration for A2A connections
• Content scanning to block PII in outgoing MCP requests
• MCP server security metrics in AI Control Tower
• OAuth Application Registry for A2A authentication

ASI05: Unexpected Code Execution -- ServiceNow Context

Risk: Agent-generated or agent-triggered code executes without sufficient validation or isolation. In ServiceNow, agents can invoke Script tools that execute server-side JavaScript, Flow Designer actions, and GlideRecord operations. An attacker who manipulates the agent's reasoning can turn natural-language requests into arbitrary code execution.

Real-world precedent: AutoGPT RCE -- natural-language execution paths unlocking code execution vectors.

ServiceNow-specific manifestation:

• Script tools in AI agents execute server-side GlideRecord operations. If an agent's prompt is hijacked (ASI01), the Script tool becomes an arbitrary code execution channel
• Now Assist for Code generates ServiceNow scripts (Business Rules, Client Scripts, Script Includes). A manipulated code generation context can produce scripts with hidden backdoors
• Flow Designer AI actions can trigger workflows that modify records, invoke REST APIs, or execute scheduled jobs
• GlideEvaluator usage in agent scripts allows arbitrary expression evaluation -- an injection vector if user-controlled input reaches the evaluator

ServiceNow controls:

• Use GlideRecordSecure() instead of GlideRecord() in all Script tools (enforces ACL context)
• Validate and sanitize all inputs in Script tool code
• Prohibit GlideEvaluator and eval() in agent scripts
• Enforce supervised execution for Script tools that modify records
• Code review process for all agent Script tool implementations

ASI06: Memory and Context Poisoning -- ServiceNow Context

Risk: Injection or leakage of agent memory or contextual state that influences future reasoning. In ServiceNow, the RAG retrieval pipeline, knowledge articles, and conversation history are all attack surfaces for persistent context poisoning.

Real-world precedent: Gemini Memory Attack -- memory poisoning reshaping agent behavior after initial interaction.

ServiceNow-specific manifestation:

// Check knowledge base articles that AI agents use for context
// Identify recently modified articles that could be poisoned
var recentKB = new GlideRecord('kb_knowledge');
recentKB.addQuery('workflow_state', 'published');
recentKB.addQuery('sys_updated_on', '>=', gs.daysAgo(7));
recentKB.orderByDesc('sys_updated_on');
recentKB.setLimit(20);
recentKB.query();
while (recentKB.next()) {
    gs.info('[ASI06] Recently modified KB: ' +
        recentKB.getValue('number') +
        ' | Title: ' + recentKB.getValue('short_description') +
        ' | Updated by: ' + recentKB.getValue('sys_updated_by'));
}

ServiceNow controls:

• Multi-level knowledge article review before publication
• Audit trails on knowledge article modifications
• Content integrity checks for AI-consumed knowledge
• ACL preservation in AI Search (automatically enforced)
• Conversation transcript retention policies to limit persistent context

ASI07: Insecure Inter-Agent Communication -- ServiceNow Context

Risk: Manipulation of messages exchanged between agents through interception, injection, spoofing, or replay attacks. In ServiceNow, agents within the same team communicate without explicit authentication, and A2A protocol creates cross-platform communication channels.

ServiceNow-specific manifestation:

• Default team grouping places all agents in the same trust domain with implicit communication trust
• Agent discoverability allows any agent to find and invoke any other agent on the same team
• No authentication between agent-to-agent invocations within the same team
• Agent2Agent (A2A) protocol creates cross-platform trust chains that extend the attack surface beyond ServiceNow
• A compromised low-privileged agent can recruit a higher-privileged agent through discovery

ServiceNow controls:

• Segment agents into purpose-specific teams (read-only vs. privileged)
• Disable default discoverability for agents that don't need cross-agent collaboration
• Implement supervised execution for cross-agent invocations
• Monitor agent-to-agent discovery and invocation events via AI Control Tower
• OAuth-based authentication for A2A protocol connections

ASI08: Cascading Failures -- ServiceNow Context

Risk: Small agent failures propagate through connected systems and automated pipelines, causing large-scale impact. In ServiceNow, hallucinated outputs from one agent feeding into another's decision-making, runaway loops, recursive invocations, and resource exhaustion can cascade across the platform.

ServiceNow-specific manifestation:

• Now Assist for Search returns an incorrect resolution path; a downstream agent auto-closes the incident based on hallucinated data
• Change impact analysis uses hallucinated CI relationships, approving a risky change
• Recursive agent-to-agent invocations create infinite loops consuming platform resources
• A single failing MCP server triggers retry storms across multiple agents
• Research shows hallucination rates of 16% for steps and 21% for tables in ServiceNow structured outputs

ServiceNow controls:

• RAG-based grounding using verified knowledge articles
• Human-in-the-loop for critical decisions (supervised execution mode)
• Confidence scoring on AI agent responses
• Rate limiting on AI agent API endpoints
• Timeout configuration for agent operations
• Circuit breakers for agent-to-agent invocation chains
• Idempotency enforcement to prevent duplicate record creation

ASI09: Human-Agent Trust Exploitation -- ServiceNow Context

Risk: An attacker exploits human over-reliance on AI agent outputs. Confident, polished agent responses mislead operators into approving harmful actions, accepting fabricated data, or bypassing verification steps they would normally perform for human-generated requests.

ServiceNow-specific manifestation:

• Now Assist generates a convincing but incorrect security assessment; a practitioner approves a change based on hallucinated risk analysis without independent verification
• An AI agent recommends granting elevated roles to resolve an access issue; the admin approves because "the AI suggested it" without checking role implications
• Virtual Agent responses contain plausible but fabricated ServiceNow property names or navigation paths; administrators follow them and misconfigure the instance
• Auto-generated incident summaries omit critical security indicators, causing SOC analysts to deprioritize genuine threats

ServiceNow controls:

• Mandatory human review for AI-recommended security changes (ACL modifications, role grants, property changes)
• Clear labeling of AI-generated content vs. verified KB content
• Confidence indicators on Now Assist responses
• Training programs on AI limitation awareness for ServiceNow administrators
• Audit trail comparison between AI recommendations and human approvals

ASI10: Rogue Agents -- ServiceNow Context

Risk: Agents act beyond their intended objectives due to goal drift, misalignment, or exceeding designed autonomy boundaries. In ServiceNow, an agent configured for one purpose gradually accumulates capabilities and begins performing actions outside its original scope.

ServiceNow-specific manifestation:

• A triage agent configured to categorize incidents begins auto-resolving them after learning from conversation patterns
• An agent with one or more tools configured to Autonomous Execution mode (per-tool setting in AI Agent Studio guided setup, per ServiceNow docs aia-security-implementation.md + add-tool-aia.md) executes privileged actions without human confirmation; supervised mode is per-tool, not a global toggle
• Default example agents (Record Management AI Agent) shipped active in production operate beyond their intended demonstration purpose
• Agent Builder allows rapid creation of agents by non-security-trained builders, creating agents that exceed intended scope from day one

ServiceNow controls:

• Strict role masking (mandatory with sn_aia store app v6.0+) to cap maximum agent capabilities
• Regular agent inventory audits via AI Control Tower
• Deactivate default example agents in production environments
• Agent activation approval workflow requiring security team sign-off
• Behavioral monitoring baselines with anomaly alerting for deviations

How to Detect

OWASP Agentic AI Compliance Audit

/*
 * AIA-004 Detection Script
 * Comprehensive audit mapping OWASP Agentic AI Top 10 (ASI01-ASI10)
 * to ServiceNow AI configuration and controls
 *
 * Run as: Background script with admin role
 * Impact: Read-only, safe for production
 * Versions: Washington+
 */

gs.info('=== AIA-004: OWASP AGENTIC AI TOP 10 AUDIT (ASI01-ASI10) ===');
gs.info('Framework: OWASP Top 10 for Agentic Applications (2026)');
gs.info('Scan started: ' + new GlideDateTime().getDisplayValue());
gs.info('');

var findings = {
    'ASI01': 0, 'ASI02': 0, 'ASI03': 0, 'ASI04': 0, 'ASI05': 0,
    'ASI06': 0, 'ASI07': 0, 'ASI08': 0, 'ASI09': 0, 'ASI10': 0
};

// ASI01: Agent Goal Hijack - Guardian configuration (UI-only per docs)
gs.info('--- ASI01: AGENT GOAL HIJACK ---');
gs.info('  [REVIEW] Verify Now Assist Admin > Settings > Now Assist');
gs.info('  Guardian > Prompt Injection toggle ENABLED with Detection');
gs.info('  impact = Block (per configure-prompt-injection-attack-protection.md).');
gs.info('  Earlier draft cited sn_now_assist.guardian.prompt_injection.mode');
gs.info('  — FABRICATED per 2026-05-09 audit.');

// ASI02: Tool Misuse and Exploitation - Check agent execution modes
gs.info('--- ASI02: TOOL MISUSE AND EXPLOITATION ---');
var autonomousAgents = new GlideRecord('sn_aia_use_case');
if (autonomousAgents.isValid()) {
    autonomousAgents.addQuery('active', true);
    autonomousAgents.addQuery('execution_mode', 'autonomous');
    autonomousAgents.query();
    var autoCount = autonomousAgents.getRowCount();
    if (autoCount > 0) {
        gs.info('  [FAIL] ' + autoCount +
            ' agents in autonomous execution mode');
        findings['ASI02'] += autoCount;
    } else {
        gs.info('  [PASS] No autonomous agents found');
    }
}

// ASI03: Identity and Privilege Abuse - Check AI service accounts + NHI
gs.info('--- ASI03: IDENTITY AND PRIVILEGE ABUSE ---');
// Execution mode is configured per tool record in AI Agent Studio guided
// setup (per ServiceNow docs aia-security-implementation.md + add-tool-aia.md);
// no global sys_property override exists. Manual review required in
// AI Agent Studio admin UI until paid-instance access is available
// for table-level detection.
gs.info('  Manual review: open each AI agent in AI Agent Studio, ' +
    'inspect Execution mode field on every tool, flag any set to ' +
    '"Autonomous" for privileged operations.');
var aiUsers = new GlideRecord('sys_user');
aiUsers.addEncodedQuery(
    'user_nameLIKEsn_aia^ORuser_nameLIKEsn_va^OR' +
    'user_nameLIKEnow_assist^ORuser_nameLIKEagent'
);
aiUsers.addQuery('active', true);
aiUsers.query();
while (aiUsers.next()) {
    var adminRoles = new GlideRecord('sys_user_has_role');
    adminRoles.addQuery('user', aiUsers.getUniqueValue());
    adminRoles.addQuery('role.name', 'IN', 'admin,security_admin,maint');
    adminRoles.query();
    if (adminRoles.hasNext()) {
        gs.info('  [FAIL] ' + aiUsers.getValue('user_name') +
            ' has elevated roles');
        findings['ASI03']++;
    }
}

// ASI04: Agentic Supply Chain Vulnerabilities - Check MCP/A2A
gs.info('--- ASI04: AGENTIC SUPPLY CHAIN VULNERABILITIES ---');
gs.info('  Manual check required: Review MCP server approvals in Agent Studio');
gs.info('  Manual check required: Audit A2A connections in OAuth Application Registry');
gs.info('  Manual check required: Verify external LLM provider configurations');

// ASI05: Unexpected Code Execution - Check script tool usage
gs.info('--- ASI05: UNEXPECTED CODE EXECUTION ---');
gs.info('  Manual check required: Audit Script tools in AI agents for GlideEvaluator usage');
gs.info('  Manual check required: Verify GlideRecordSecure usage in agent scripts');

// ASI06: Memory and Context Poisoning - Check KB modification audit
gs.info('--- ASI06: MEMORY AND CONTEXT POISONING ---');
var kbChanges = new GlideRecord('sys_audit');
kbChanges.addQuery('tablename', 'kb_knowledge');
kbChanges.addQuery('sys_created_on', '>=', gs.daysAgo(30));
kbChanges.query();
gs.info('  KB article audit records (30 days): ' + kbChanges.getRowCount());

// ASI07: Insecure Inter-Agent Communication - Check team grouping
gs.info('--- ASI07: INSECURE INTER-AGENT COMMUNICATION ---');
gs.info('  Manual check required: Verify agent team segmentation');
gs.info('  Manual check required: Verify discoverability settings per agent');
gs.info('  Manual check required: Review A2A OAuth authentication configurations');

// ASI08: Cascading Failures - guardrails and resource controls (UI-only)
gs.info('--- ASI08: CASCADING FAILURES ---');
gs.info('  [REVIEW] Verify Now Assist Admin > Settings > Now Assist');
gs.info('  Guardian Prompt Injection + Offensiveness toggles enabled');
gs.info('  (per now-assist-guardian.md). Earlier draft cited');
gs.info('  sn_now_assist.guardian.enabled — FABRICATED.');
gs.info('  Manual check required: Verify rate limiting on AI endpoints');
gs.info('  Manual check required: Verify timeout configuration for agent operations');

// ASI09: Human-Agent Trust Exploitation
gs.info('--- ASI09: HUMAN-AGENT TRUST EXPLOITATION ---');
gs.info('  Manual check required: Verify AI-generated content labeling');
gs.info('  Manual check required: Verify mandatory human review for security changes');

// ASI10: Rogue Agents - Check for unmanaged/stale agents
gs.info('--- ASI10: ROGUE AGENTS ---');
// Earlier draft cited sn_now_assist.data_privacy.enabled — FABRICATED.
// Data Privacy is UI-only per configure-privacy-policies.md.
gs.info('  [REVIEW] Verify Now Assist Admin > Settings > Privacy Policies');
gs.info('  has an active anonymization policy. PII exposure in logs is');
gs.info('  controlled via Now Assist Admin UI, not sys_property.');
// Check for stale agents
var staleAgents = new GlideRecord('sn_aia_use_case');
if (staleAgents.isValid()) {
    staleAgents.addQuery('active', true);
    staleAgents.addQuery('sys_updated_on', '<=', gs.monthsAgo(6));
    staleAgents.query();
    var staleCount = staleAgents.getRowCount();
    if (staleCount > 0) {
        gs.info('  [FAIL] ' + staleCount + ' agents not updated in 6+ months');
        findings['ASI10'] += staleCount;
    }
}
gs.info('');

// Summary
var totalFindings = 0;
gs.info('=== OWASP AGENTIC AI TOP 10 SUMMARY ===');
var riskNames = {
    'ASI01': 'Agent Goal Hijack',
    'ASI02': 'Tool Misuse and Exploitation',
    'ASI03': 'Identity and Privilege Abuse',
    'ASI04': 'Agentic Supply Chain Vulnerabilities',
    'ASI05': 'Unexpected Code Execution',
    'ASI06': 'Memory and Context Poisoning',
    'ASI07': 'Insecure Inter-Agent Communication',
    'ASI08': 'Cascading Failures',
    'ASI09': 'Human-Agent Trust Exploitation',
    'ASI10': 'Rogue Agents'
};
for (var risk in findings) {
    var status = findings[risk] === 0 ? 'PASS' : 'FAIL';
    gs.info('  ' + risk + ' (' + riskNames[risk] + '): ' + status +
        (findings[risk] > 0 ? ' (' + findings[risk] + ' issues)' : ''));
    totalFindings += findings[risk];
}
gs.info('');
gs.info('Total findings: ' + totalFindings);
gs.info('');
gs.info('REMEDIATION PRIORITY:');
gs.info('1. [ASI03] Patch CVE-2025-12420, enforce unique agent identities, Machine Identity Console');
gs.info('2. [ASI01/ASI07] Enable Guardian, segment agent teams, disable default discoverability');
gs.info('3. [ASI02/ASI05] Enforce supervised execution, restrict tool access, audit Script tools');
gs.info('4. [ASI04] Review MCP server approvals, audit A2A connections');
gs.info('5. [ASI06/ASI08] Implement RAG grounding, KB integrity checks, rate limiting');
gs.info('6. [ASI09/ASI10] AI content labeling, human review for security changes, stale agent cleanup');

Remediation

Priority 1: Identity, Authentication, and Supply Chain (ASI03, ASI04)

1. Patch all known AI authentication vulnerabilities (CVE-2025-12420)
2. Implement unique per-instance agent credentials
3. Deploy Machine Identity Console for NHI visibility
4. Configure Machine Identity ACLs for agent service accounts
5. Enforce runtime authorization with short-lived tokens
6. Deploy distinct AI User accounts (not Dynamic User)
7. Quarterly privilege review for all AI service accounts
8. Set every privileged tool's Execution mode to "Supervised" per AI agent in AI Agent Studio guided setup (per-tool, not global)
9. Enforce MCP server approval mandates in Agent Studio
10. Audit A2A connections in OAuth Application Registry

Priority 2: Guardrails, Goal Protection, and Communication (ASI01, ASI05, ASI07)

1. Enable Now Assist Guardian in "Block and Log" mode
2. Segment agent teams by function and privilege level
3. Disable automatic agent discoverability
4. Implement input sanitization for AI-processed records
5. Deploy supervised execution for all write operations
6. Add semantic validation for critical agent actions
7. Audit Script tools for GlideEvaluator/eval() usage
8. Enforce GlideRecordSecure() in all agent scripts
9. Configure OAuth authentication for A2A protocol connections

Priority 3: Monitoring, Data Integrity, and Resilience (ASI06, ASI08)

1. Enable AI Control Tower for centralized governance
2. Implement correlation IDs for agent-to-agent chains
3. Enable audit on all AI agent configuration tables
4. Configure appropriate log retention (minimum 1 year)
5. Enable Data Privacy for Now Assist (PII masking)
6. Create dashboards for AI agent activity monitoring
7. Implement RAG grounding for all AI-generated responses
8. Deploy KB article integrity validation
9. Configure rate limiting and timeouts on AI endpoints
10. Implement circuit breakers for recursive agent invocations

Priority 4: Human Oversight and Agent Governance (ASI02, ASI09, ASI10)

1. Restrict AI agent tool access via whitelist approach
2. Implement mandatory human review for security-impacting AI recommendations
3. Deploy clear labeling of AI-generated vs. verified content
4. Agent activation approval workflow with security team sign-off
5. Deactivate default example agents in production
6. Quarterly stale agent audit (deactivate unused agents >90 days)
7. Implement agent behavioral baselines with anomaly alerting
8. Training programs on AI limitations for ServiceNow administrators

Regulatory Impact

NIS2 Mapping

DORA Mapping

ISO 27001:2022 Mapping

Expert Notes

Framework Cross-Reference

Key Insight: Defense-in-Depth Across All 10 Risks

No single ServiceNow control addresses more than 2-3 of the ASI risks. The correct posture layers controls:

1. Guardian -- ASI01, ASI06 (detection layer)
2. Supervised execution + role masking -- ASI02, ASI03, ASI05, ASI10 (authorization layer)
3. Agent team segmentation -- ASI07 (isolation layer)
4. MCP/A2A approval mandates -- ASI04 (supply chain layer)
5. AI Control Tower -- ASI08, ASI09, ASI10 (monitoring layer)
6. Machine Identity Console -- ASI03 (identity layer)

ServiceNow characterized the prompt injection findings as "expected behavior within current defaults" (November 2025). The vendor position is that administrators are responsible for hardening agent configurations. The secure configuration is your responsibility -- it will not be delivered out of the box.