iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Build and govern a ServiceNow AI agent in AI Agent Studio: assign the sn_aia.admin role, create the agent, define an invocation ACL, choose a least-privileged run-as identity, add only necessary tools, require human approval for sensitive actions, test in a non-production context, and document an operating owner and rollback path. Governance is not one setting. The ACL controls who can discover or invoke an agent; the run-as identity and role masking control what it can read or change after invocation.
The sequence below follows ServiceNow’s documented setup flow and extends it into a practical control system for one agent or a large portfolio. Labels and prerequisites can change by release, patch, license and installed applications, so validate them against the target instance before enabling production use.
What an AI agent is in ServiceNow
A ServiceNow AI agent is a task-oriented software component that can interpret a request, select approved tools, retrieve information and, when permitted, take action in the platform. It differs from a simple prompt-and-response assistant because it can execute workflows, update records or call other capabilities. That autonomy makes access design and operational oversight as important as the agent’s instructions.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsAI Agent Studio is the primary surface for creating, configuring and testing agents. The documented flow uses Create and manage > AI agents > New, followed by security controls, optional triggers, channels and a save-and-test step. The exact controls visible to an administrator depend on the instance release, installed applications and entitlements.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Prepare the instance before creating an agent
Confirm licensing and release readiness
Verify that the instance is licensed for the AI Agent Studio capabilities you plan to use and that the required applications are installed. Record the family release, patch level and any plugin dependencies. Documentation prerequisites are not a substitute for an entitlement check: an agent can appear in the interface while a channel, tool or external-connection feature remains unavailable under the current subscription.
For external-agent connectivity, ServiceNow documentation requires the Zurich patch 4 or later prerequisite. Do not enable Agent2Agent connections until the target instance meets that level and the connection design has been reviewed.
Assign administrative roles deliberately
The documented creation procedure requires sn_aia.admin. Grant it through a controlled administrator group rather than permanently to every developer or requester. Separate the people who build agents from those who approve production activation when your change process supports that separation.
Before work starts, identify the roles needed to test every tool. The creator may be able to configure an agent but still receive authorization failures when testing a data lookup, record update or workflow action. Keep a written list of test roles and distinguish them from the roles the production agent will receive through its run-as configuration.
Complete a readiness assessment
ServiceNow’s governance guidance emphasizes that responsible deployment requires more than configuring individual features. Assess the use case, data classification, affected users, business owner, escalation route and expected failure impact. For a multi-business-unit instance, decide whether domain separation is required before you design the agent’s tools or prompts.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
- Define the business outcome in one sentence and name an accountable owner.
- List the records, tables, knowledge sources, attachments and external systems the agent may encounter.
- Classify actions as read-only, reversible update, irreversible change or high-impact decision support.
- Identify regulated or consequential contexts, including healthcare, finance, legal, employment, security and infrastructure operations.
- Choose a non-production test scope and a production rollback or disable procedure.
Create the agent in AI Agent Studio
- Open the build surface. In the ServiceNow navigator, go to Create and manage > AI agents, select New, and confirm that the agent record opens in AI Agent Studio.
- Name and specialize it. Use a name that states the business task, such as “VPN access triage,” rather than a broad label such as “IT helper.” Define the specialty, boundaries and intended audience in the agent instructions. State what the agent must not do, when it must ask for clarification and when it must hand off to a person.
- Describe the operating context. Specify the systems of record, terminology, date or time assumptions, required evidence and acceptable response format. Instructions should tell the agent to distinguish facts retrieved from records from assumptions supplied by the requester.
- Configure user access. Set the invocation ACL to specified roles, authenticated users or public access only when the use case justifies that exposure. Start with the narrowest audience. An ACL answers who may discover or invoke the agent; it does not define the permissions the agent receives after invocation.
- Choose the data-access identity. Select Dynamic user when the agent should operate in the invoking user’s context. Apply approved-role role masking to narrow that context to the roles required for the task. Select a dedicated AI user only when a controlled service identity is necessary and its roles, ownership and credential lifecycle are documented.
- Add tools sparingly. Attach only the lookups, actions and workflows required to meet the stated outcome. Remove convenience tools that expand table, attachment, notification or administrative access. For each tool, record the input fields, output data, target tables, side effects and failure behavior.
- Set approval behavior. Use supervised execution for tools that change records or perform sensitive or critical actions. The agent may prepare the call, but a human must approve it before execution. Define who can approve, what evidence the approver sees and what happens when approval is denied or expires.
- Add automation only when intended. Configure an event trigger when a record or event should start the agent without a person opening a chat. If automation is not required, expose the agent through the selected chat channels instead. Avoid adding a trigger merely because it is available; event-driven execution can multiply volume and consequences.
- Select channels and access points. Enable only the channels needed by the audience. Check that the channel’s own authentication and audience controls do not broaden the agent’s ACL.
- Activate, then save and test. Follow the documented activation and Save and test flow. Perform the test with the administrative and tool roles required by the configuration, while also testing with representative lower-privilege users.
Understand the two separate access decisions
Many insecure designs treat “who can use the agent” and “what the agent can do” as one problem. They are separate controls and must be reviewed separately.
| Decision | Control | Question it answers | Typical design choice |
|---|---|---|---|
| Invocation and discovery | Agent ACL | Which users may find, open or invoke this agent? | Named roles or authenticated users; public only for a justified, low-risk use case |
| Data and action authority | Run-as identity | Which identity supplies permissions after invocation? | Dynamic user for user-context access, or a dedicated AI user for a controlled service identity |
| Privilege narrowing | Role masking | Which roles from the invoking or dedicated identity remain effective? | Mask to an approved minimum role set |
| Action confirmation | Supervised execution | Must a person approve a tool call before it runs? | Yes for sensitive, critical or consequential changes |
Dynamic user
With Dynamic user, the agent inherits the invoking user’s context. This can provide useful record-level behavior, but it also means a broadly privileged requester may expose more data or actions than a normal chat experience would. Use role masking to constrain the effective roles to those approved for the agent’s task. Test the same prompt with users who have different roles and domain visibility.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Dedicated AI user
A dedicated AI user gives the agent a stable service identity. That can simplify audit trails and controlled automation, but the user’s roles become the agent’s potential authority. Create a dedicated identity only with an owner, credential rotation process, inactivity review and a role set limited to the agent’s documented tools. Do not treat a service identity as a reason to grant broad administrative roles.
Role masking and least privilege
ServiceNow states that role masking should be applied as a security best practice and to follow least privilege. Keep the mask in place unless a documented exception is approved by the relevant security or risk owner. ServiceNow explicitly says overriding the role-masking requirement is not recommended. A useful review question is: “If this tool were compromised or mis-invoked, what is the smallest set of records and actions it could affect?”
Design tools and approvals for safe execution
Separate read, recommend and change capabilities
Start with read-only tools that let the agent gather evidence. Add recommendation or draft capabilities next. Add record-changing tools only when the business benefit requires them, and keep irreversible operations behind a separate approval step. A tool that can update a ticket, reset access, modify configuration or send a customer-facing message should not be bundled into a general-purpose agent without an explicit control decision.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Use supervised mode for consequential actions
ServiceNow documents supervised mode to enhance security for agents capable of sensitive or critical actions. In supervised mode, the agent can assemble the proposed tool call and its arguments, while a human reviews and approves execution. The approval screen or record should make the target, proposed change, affected user or system, evidence and expected consequence understandable without reconstructing the entire conversation.
Define a denial path. A denied approval should leave the original record unchanged, tell the requester that a person declined or that more information is needed, and create an audit event suitable for review. If a tool can partially succeed, document how the agent detects and reports that condition.
Control data returned to the model and user
Minimize fields and attachments returned by tools. Mask secrets, tokens, personal data and unnecessary historical content. Check that a search tool does not bypass table ACLs, domain boundaries or attachment restrictions. Treat generated summaries as derived content: users should be able to open the authoritative record when they need to verify a decision.
Triggers, channels and external agents
Event triggers
An event trigger is appropriate when a defined record or system event should start the agent automatically. Specify the event conditions, expected volume, deduplication behavior and stop condition. Test bursts and repeated updates; an automation that is safe for one record can create a queue or notification storm when thousands of records match.
Chat channels
For conversational use, expose the agent through only the channels required by its audience. Confirm the channel’s sign-in method, transcript retention and attachment behavior. A channel should not be used to circumvent the agent ACL or to expose an agent to anonymous users when the underlying data is private.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Agent2Agent connectivity
For third-party or external agents, verify the Zurich patch 4 or later requirement, authenticated connection or credential aliases, and ACLs governing discovery and execution before enabling Agent2Agent connectivity. Treat the external agent as an untrusted caller until its identity, allowed operations, data exchange and failure behavior are documented. Rotate credentials, review connection ownership and disable stale integrations.
Test an agent before production
The official procedure confirms the Save and test flow and its role prerequisites, but it does not define a universal test corpus or success-rate target. Set those locally and retain the evidence in your normal change, risk or model-governance records.
Build a representative test set
Use realistic requests drawn from the intended process, including incomplete, ambiguous and out-of-scope requests. Include records from every domain or business unit the agent is expected to support. Do not test only with the administrator account; an administrator can hide permission defects.
Run security and failure tests
- Permission-boundary tests: compare an allowed user, a user with a similar but unauthorized role, and a user with no relevant role.
- Denied-access tests: request records, fields, attachments and domains the requester must not see. Confirm that the agent refuses without leaking values or metadata.
- Tool-failure tests: simulate timeouts, malformed inputs, missing records, duplicate submissions and partial completion. Verify a clear user message and a recoverable state.
- Prompt-injection tests: place instructions in records, comments or attachments that attempt to override the agent’s rules, reveal hidden data or invoke unrelated tools.
- Unsafe-action tests: ask for high-impact changes without the required evidence or approval. Confirm that the agent pauses, asks for clarification or escalates.
- Human-escalation tests: verify routing, context transfer, ownership and service-level expectations when the agent cannot safely complete a request.
- Trigger-volume tests: for event-driven agents, test bursts, retries and duplicate events in a controlled environment.
Capture observable evidence
Retain traces, prompts, tool calls, approval decisions, outputs, errors and incident references according to the organization’s retention policy. Record the test instance, release, role set, data domain and expected result. A pass should mean more than “the answer looked plausible”; it should show that access boundaries, approvals and failure handling behaved as designed.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Document the production control record
Before activation, create an inventory entry containing:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
- Agent name, owner, business purpose and supported channels.
- Data domains, tables, fields, attachments and external systems in scope.
- Invocation ACL, run-as identity, role mask and approved roles.
- Every tool, its side effects, input validation and approval requirement.
- Event triggers, expected volume and duplicate-event handling.
- Representative test prompts, expected outcomes and evidence locations.
- Escalation contacts, support hours and user-facing fallback instructions.
- Change-approval record, activation date, review cadence and rollback or disable procedure.
Use versioned changes for instructions, tools, role masks, ACLs, channels and triggers. A seemingly minor prompt change can alter tool selection, so route it through the same impact assessment as a workflow or ACL change.
Apply domain separation and high-impact safeguards
Domain separation
When multiple business units or tenants share an instance and require data or process isolation, plan domain separation before deployment. Test cross-domain searches, references, notifications, approvals and escalations. A user may be authorized to invoke an agent in one domain while remaining unable to access records in another; the agent must preserve that boundary under both Dynamic user and dedicated AI user designs.
Consequential use cases
Healthcare, finance, legal, employment, security and infrastructure operations merit heightened review. Apply the ServiceNow AI Acceptable Use Policy and the organization’s own privacy, records, security and human-review requirements. For decisions that affect a person’s eligibility, employment, access, safety or legal position, define the human decision-maker and ensure the agent supplies evidence rather than silently making the decision.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Operate and review agents continuously
Monitor more than availability
Track invocation volume, completion and escalation rates, denied tool calls, approval outcomes, permission errors, latency, repeated failures and incidents. These are instance-specific operational measures, not universal performance benchmarks. Establish a baseline during a controlled rollout and set thresholds that trigger investigation.
Review access and behavior
On a scheduled cadence, revalidate the owner, ACL, role mask, AI-user roles, tools, trigger conditions, connection aliases and data domains. Review whether the business process changed or whether a tool is no longer needed. Remove dormant agents and disable unused external connections.
Respond to incidents
- Disable the agent, trigger or affected tool when continued execution could cause harm.
- Preserve traces, approvals, record states and connection logs.
- Determine whether the issue involved instructions, ACLs, identity, role masking, tool validation, domain boundaries or an external credential.
- Contain affected records and notify the responsible security, privacy, risk or service owner.
- Correct the configuration, add a regression test and obtain approval before reactivation.
Govern a portfolio with AI Control Tower
One or two agents can be managed through normal platform administration and change records. A broad portfolio spanning agents, models and workflows benefits from a centralized governance layer. ServiceNow positions AI Control Tower for centralized governance, security, compliance and value realization across that portfolio.
Evaluate it against the controls your organization actually needs: inventory completeness, ownership, policy enforcement, risk evidence, access review, lifecycle status, cost or usage visibility and outcome tracking. It does not remove the need to configure each agent’s ACL, identity, tools and approvals; it provides a portfolio view and control process around them.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
| Implementation approach | Best fit | Strengths | Operating burden |
|---|---|---|---|
| Single-agent administration | One contained use case with a clear owner | Fastest setup; direct control of ACLs, identity, tools and tests | Manual inventory, reviews and evidence |
| Standardized agent lifecycle | Several teams building agents in one instance | Reusable intake, test, approval, release and review gates | Requires process ownership and consistent records |
| AI Control Tower governance | Large portfolio across agents, models and workflows | Centralized security, compliance, governance and value tracking | Additional implementation, licensing and operating design; packaging must be confirmed for the target environment |
| External Agent2Agent integration | Controlled collaboration with agents outside the instance | Extends automation across systems | Credential, ACL, patch, data-transfer and incident-management complexity |
Common failure modes and fixes
| Symptom | Likely cause | Corrective action |
|---|---|---|
| The agent is visible to the wrong audience | ACL is broader than intended or a channel has separate exposure | Restrict the ACL, review channel authentication and retest discovery with multiple roles |
| The agent can read or change too much | Run-as identity has broad roles or role masking is absent | Apply a minimum role mask, remove unnecessary AI-user roles and repeat boundary tests |
| Testing works only for the creator | Creator has administrative or tool roles not present in production | Test with representative production roles and document each required permission |
| A sensitive action executes immediately | Tool was not configured for supervised execution | Put the tool behind human approval and test approval, denial and timeout paths |
| Automated runs multiply unexpectedly | Trigger matches updates generated by the agent or lacks deduplication | Add event filters, loop protection and volume limits; test repeated updates |
| Agent2Agent setup cannot authenticate | Unsupported patch level, missing credential alias or missing discovery/execution ACL | Confirm Zurich patch 4 or later, validate the connection identity and grant only required ACLs |
| Users receive confident but unsupported answers | Instructions do not require evidence or escalation | Require source-record references, uncertainty handling and human handoff for unresolved cases |
A practical go-live checklist
- License, release and patch prerequisites are confirmed.
sn_aia.adminaccess is limited to authorized administrators.- Purpose, owner, audience, data domains and prohibited uses are recorded.
- Invocation ACL and run-as identity were reviewed as separate decisions.
- Role masking is enabled and the approved role set is documented.
- Only required tools are attached; sensitive tools require human approval.
- Triggers, channels and external connections are intentionally enabled.
- Representative, boundary, injection, failure and escalation tests passed.
- Traces, approvals and test evidence are retained in normal governance records.
- Rollback, disable, incident and periodic-review procedures are ready.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
