Overview
When an issue is raised in GRC, the hardest part often isn't identifying the problem — it's knowing what to do next. Issue owners struggle to identify the right remediation steps and owners, leading to delays in task assignment, prolonged resolution times, and challenges in tracking progress.
The Optimize GRC Issue Resolution use case addresses this by guiding issue owners through an AI-driven resolution workflow. From the Now Assist Panel on an issue record in Analyze state, clicking the Generate GRC Issue Action Plan option triggers the use case. It automatically generates a structured action plan based on how similar issues were resolved in the past, and then breaks that plan down into concrete remediation tasks that are created directly on the issue record.
The use case is made up of two AI agents that work in sequence — the Issue Action Plan AI Agent and the Remediation Tasks AI Agent — coordinated by an orchestrator that manages the handoff between them.
Where to find it
All → Now Assist AI Agents → AI Use Cases → search for Optimize GRC Issue Resolution
What Is This Use Case Trained On?
This use case does not use a custom-trained model. It combines two sources of intelligence, both grounded in your own ServiceNow instance:
|
Source |
What It Uses |
How |
|---|---|---|
|
Your resolved issues |
Closed issues from your instance that already have an action plan or remediation tasks |
Semantic search against indexed issue records |
|
AI reasoning |
NowAssist Skill (GPT / Claude / Gemini) |
Prompt fed with action plans and remediation task patterns from matched issues |
End-to-End Flow
The use case is triggered by clicking Generate GRC Issue Action Plan in the Now Assist Panel on an issue in Analyze state. The use case starts and immediately hands control to Agent 1. Once Agent 1 completes, control returns to the use case — which then asks whether you want remediation tasks. Depending on your response, the use case either triggers Agent 2 or ends the workflow. The diagram below shows the complete flow; a detailed breakdown of each agent and its tools follows.
The Orchestrator
The Optimize GRC Issue Resolution use case is not a single agent — it is an orchestrator that coordinates two specialist agents in sequence. It is the starting point of the workflow and the one in control throughout.
When triggered, the use case immediately hands control to Agent 1. Agent 1 runs its full flow — fetching issue details, searching similar resolved issues, generating an action plan, and presenting it for review. Once the user accepts and the plan is saved, control returns to the use case. The use case then asks: "Would you like me to suggest remediation tasks for this issue?" If yes, it triggers Agent 2. If no, it ends the workflow with the message "Workflow terminated as requested." If the user dismisses the action plan inside Agent 1, Agent 2 is never triggered.
Agent 1: Issue Action Plan AI Agent
This agent finds similar resolved issues from your instance and synthesizes a recommended action plan. It presents the plan for your review and saves it to the issue record only after you accept it.
Tool 1: Get Issue Detail
This is the agent's first act. It fetches the details of the current issue record — the short description, full description, issue number, and record identifier — so that everything downstream has a reliable, consistent picture of what the issue is about.
If the issue record cannot be found, the agent notifies you and stops. It also checks that you have permission to read the record before proceeding.
Tool 2: Issue Resolution Agent Usage Status Update
As soon as the issue record is found, the agent marks it as having had the AI resolution workflow triggered. This update is made to the issue record itself and serves as an audit trail — administrators and triage teams can see at a glance that the AI workflow was initiated on this record.
Tool 3: Generate Issue Action Plan
This is the core of Agent 1. It finds resolved issues from your instance that are similar to the current one, and uses their action plans and remediation task history to synthesize a recommended action plan.
How it finds similar issues
The tool searches your instance's closed issues — those marked as Closed Complete or Closed Incomplete — using the short description of the current issue as the search query. It uses semantic matching, so it understands meaning rather than relying on exact keywords. A past issue must be sufficiently similar to be considered — the threshold is deliberately set high to ensure only genuinely relevant patterns inform the plan.
For each match, the tool retrieves the issue's existing action plan and all its linked remediation tasks. It also surfaces a citation link so the generated plan is traceable back to the source records. The current issue is always excluded from its own search results.
How the action plan is generated
The AI model analyzes the action plans and remediation task descriptions across all matched issues and synthesizes a new recommended plan. It looks for common patterns and recurring steps — it does not copy any single past plan verbatim. The generated plan uses a numbered list format so it is easy to review and edit.
If the matched issues do not contain enough consistent patterns to generate a meaningful plan, the agent informs you rather than producing a vague or generic output.
How the plan is formatted before display
After the AI model generates the raw plan, a post-processor runs automatically. It formats the output into a clean numbered list and appends a note — "The generated action plan is based on previous similar issues" — so the source of the suggestion is always visible to you. If the model returns no plan, the post-processor surfaces a clear message rather than showing raw output.
Reviewing and refining the plan
Once the action plan is presented, you have three choices:
Accept — the plan is saved to the issue record and the orchestrator moves to the next step
Edit — you describe what you'd like changed and the agent refines the plan incorporating your feedback. No new search is run at this stage. You can repeat this as many times as needed before accepting
Dismiss — the workflow ends. You can populate the action plan field manually on the issue record
Tool 4: Save Action Plan
Once you accept the action plan, this tool updates two fields on the issue record:
Action Plan — the accepted plan is written here and is immediately visible on the issue record to anyone with access, without needing to return to the Now Assist Panel
AI Usage Status — updated to Assisted, indicating that the action plan on this issue was generated with AI assistance. This is distinct from the Triggered status set earlier by Tool 2, which simply recorded that the workflow was initiated
Agent 2: Remediation Tasks AI Agent
This agent reads the action plan that was just saved to the issue and breaks it down into individual, actionable remediation tasks — each with a clear name and a detailed description. It creates those tasks directly on the issue record after you review and accept them.
Tool 1: Suggest Remediation Tasks for the Issue
This tool reads the action plan directly from the issue record and asks the AI model to extract a list of concrete tasks that a GRC analyst could act on.
What each suggested task contains
Each suggested task has two parts:
Name — a concise sentence that clearly describes what the task is
Description — a detailed explanation including context, objectives, relevant steps, and any considerations or timelines for completing it
How tasks are generated
The AI model works strictly from the content of the action plan — it does not infer tasks beyond what the plan contains. If no action plan exists on the issue record when this agent runs, it returns no suggestions rather than generating anything speculative.
The model is configured to produce consistent, deterministic output — the same action plan will produce the same set of task suggestions each time.
How tasks are formatted before display
After the model generates the task list, a post-processor runs and formats each task with a bold Name followed by its Description, and prepends "Based on the action plan, here are the suggested remediation tasks:" at the top. This consistent structure makes it easy to scan and review each task before accepting. If the model returns no tasks, the post-processor surfaces a clear message.
Reviewing and refining the tasks
Once the suggested tasks are presented, you have three choices:
Accept — all suggested tasks are created on the issue record
Edit — you describe what you'd like changed and the agent refines the task list. The updated tasks are shown in a Name / Description format. You can repeat this before accepting
Dismiss — no tasks are created. You can create remediation tasks manually from the issue page
Tool 2: Create Remediation Task
Once you accept the suggested tasks, this tool creates each one as a remediation task record linked to the current issue. Each task is created with the name and description from the suggestions.
Duplicate prevention
Before creating each task, the tool checks whether a task with the same name and description already exists on the issue. If it does, that task is skipped and a count of skipped tasks is reported. This means running the use case a second time on the same issue will not create duplicate tasks.
What happens after tasks are created
The created tasks appear on the issue record and are accessible from the issue page. The agent confirms creation with clickable links to each new task. Task owner assignment is intentionally left to you — the agent does not assign owners automatically.
Customizing the Use Case
The Optimize GRC Issue Resolution use case supports a range of customizations — from adjusting which past issues are used as reference data, to tuning how many are retrieved, editing the prompts that generate the action plan and remediation tasks, and modifying agent behavior and messaging.
For the full customization guide, refer to: Customizing the Optimize GRC Issue Resolution Use Case.
Frequently Asked Questions
What if my organization has no resolved issues yet?
The action plan generation relies on past resolved issues. If your instance has no closed issues with an action plan or remediation tasks, the agent will inform you that it cannot generate a plan due to insufficient information. As your team resolves more issues and populates action plans, the quality and coverage of suggestions will improve automatically.
Does the use case look at open or in-progress issues?
No. Only issues in a Closed Complete or Closed Incomplete state are used as reference data. This ensures suggestions are based on issues that were actually worked through to resolution.
What if I dismiss the action plan — can I still get remediation tasks?
No. The remediation task agent runs only after an action plan has been accepted and saved to the issue record. If you dismiss the action plan, the workflow ends. You can trigger the use case again from the Now Assist Panel if you change your mind.
Can I run this use case again on the same issue?
Yes. If you run it again, the agent will generate a fresh action plan. For remediation tasks, any task that already exists on the issue with the same name and description will be skipped — so re-running will not create duplicates.
Who can access this use case?
Access is controlled by both license and role. The Generate GRC Issue Action Plan option in the Now Assist Panel is only shown to users who have the required role and whose instance has the use case licensed and active.
