Skip to content
Agentic AI security and governance
Release: Australia · Updated: 2026-03-26 · Official documentation · View source

Create and secure an AI agent in Now Assist

Plan, build, secure, test, and deploy a Now Assist AI agent.

Use this tutorial to go through the full life-cycle of creating an AI agent on the ServiceNow AI Platform. Security configuration (controlling access, protecting data, and enabling guardrails) is integrated at each phase rather than treated as separate steps.

This tutorial is intended for ServiceNow AI Platform administrators and AI developers who are building and deploying AI agents for the first time. It assumes familiarity with the ServiceNow AI Platform but no prior experience building AI agents.

Before you begin

Before starting this tutorial, verify the following:

  • A Now Assist license that includes AI agents.
  • Administrator access to your instance.
  • You should have the sn_aia.admin, sn_nowassist_admin.nsa_admin, and sn_generative_ai.data_steward roles assigned to you or users to whom you will delegate tasks. Further details on roles can be found in Assess readiness.

How the security model works

Reviewing the Now Assist security model before you build can help make configuration decisions easier.

  • Access Control Lists

    Determine who can discover and invoke an agent or agentic workflow. ACLs are configured on the agent itself and are checked before the agent executes.

  • User identity

    Determines what data the agent can access once invoked. A dynamic user agent inherits the invoking user's roles. An AI user agent runs as a dedicated system user with fixed assigned roles.

  • Now Assist Guardian

    Monitors prompts and responses at runtime to detect offensive content, prompt injection attempts, and sensitive subjects. Guardian runs independently of ACLs and user identity.

Tutorial steps

Complete the following steps in order:

  • 1. Assess readiness

    Verify your instance is ready for AI agent deployment and assign the roles needed to build and manage agents.

  • 2. Plan your agent

    Define your use case, choose between an OOTB and custom agent, and set your success criteria.

  • 3. Build your agent

    Create your agent in AI Agent Studio, configure tools, and set access controls.

  • 4. Configure security controls

    Configure Now Assist Guardian guardrails and data privacy settings.

  • 5. Test and validate

    Test agent execution, verify access controls, and run automated evaluations.

  • 6. Go live and monitor

    Deploy to production and set up ongoing monitoring.

  • Assess readiness
    Verify that your instance is prepared for AI agent deployment, install the required applications, assign the required roles, and classify user identity types before you begin building.

  • Plan your agent
    Define your use case, decide between an base system and custom agent, choose an activation model, and set your success criteria before you begin building.
  • Build your agent
    Create your agent in AI Agent Studio, configure its tools and knowledge sources, and set the access controls that determine who can invoke it and what data it can access.
  • Configure security controls
    Set up Now Assist Guardian guardrails and data privacy controls to protect your AI agent interactions before testing begins.
  • Test and validate
    Test your agent's execution and access controls, run automated evaluations, and review Guardian logs before approving the agent for production deployment.
  • Go live and monitor
    Deploy your agent to production, activate analytics and monitoring, and establish the ongoing review cadence that keeps your agent performing securely over time.

Parent Topic:Agentic AI security and governance