Agent Identity and Permissions Emerge as First-Class Controls in ServiceNow's Enterprise AI Governance Platform

What happened

Why it matters

• ·Regulatory exposure: Frameworks including the EU AI Act and DORA already embed accountability and traceability requirements for automated decision-making, and organizations that cannot demonstrate bounded agent permissions or produce agent-level audit logs face material compliance gaps in those jurisdictions.
• ·Operational impact: Agentic AI systems can chain tasks, invoke APIs, and trigger downstream workflows autonomously at scale without per-step human review, meaning existing model-level governance programs built around human-initiated prompts do not capture the actions or authorization states of deployed agents.
• ·Organizational risk: AI agents that inherit broad permissions from a parent application will not surface in model-level registries, leaving audit and compliance teams unable to answer basic questions about which agent accessed which system, under what authorization, and with what outcome.

Governance controls affected

What to do now

• ☐Audit the organization's AI system inventory to confirm that AI agents are captured as distinct entries separate from the models or platforms that host them, including all agents deployed on ServiceNow and other orchestration platforms.
• ☐Review existing identity and access management policies to determine whether they formally extend to non-human AI actors, and document any gaps in least-privilege provisioning, permission review cycles, and independent audit log access.
• ☐Draft a formal agent credential lifecycle control covering provisioning, permission scoping, rotation, suspension, and decommissioning for AI agents, prioritizing this work rather than waiting for a regulatory mandate.
• ☐Verify that agent action logs are written to a system that compliance and audit teams can query independently of the platform vendor, and confirm those logs meet retention and tamper-evidence requirements.
• ☐Prioritize the above steps for deployments in regulated sectors such as financial services, healthcare, and critical infrastructure, where EU AI Act high-risk system logging and DORA accountability obligations create near-term enforcement exposure.

What to watch next

Compliance teams should monitor whether other major enterprise platform vendors follow ServiceNow's lead in formalizing agent identity as a governance primitive, as convergence across platforms would accelerate pressure on regulators to codify agent-level access control requirements in binding guidance. Ongoing EU AI Act implementing measures and expected NIST AI RMF supplementary guidance on agentic systems are likely to introduce more explicit traceability and authorization obligations that would make agent identity controls mandatory rather than voluntary. Teams should also track enforcement signals from data protection authorities in the EU and UK, where existing accountability principles under GDPR and UK GDPR may already be interpreted to require the kind of agent-level audit trails that ServiceNow's platform is designed to produce.