How does AI Control Tower handle governance for third-party AI agents alongside native SNow agents ?

[Surya247]

Background & Context:

With the launch of AI Control Tower at Knowledge 2025, ServiceNow positioned it as a unified command center for governing any AI agent — native or third-party. The platform promises enterprise-wide visibility to monitor and manage every AI agent, model, and workflow in one place, applying consistent policies across the enterprise.

That's a bold claim — and one I'm trying to validate in our environment. We currently run a mix of native Now Assist agents alongside external AI tools from Microsoft Copilot and Google Cloud. Before we commit to AI Control Tower as our central governance layer, I have a few open questions I'd love the community's help on.

My specific questions:

1. How does onboarding work for third-party agents? The documentation mentions registering AI models using metadata fields to specify intent, scope, input/output formats, and associated risks — but how manual is this process for agents that weren't built on the Now Platform? Is there an API or connector-based registration flow, or does each third-party agent need to be manually catalogued? 

2. Are governance policies truly unified, or are they applied differently to native vs. third-party agents? The platform covers native Now Platform agents, external AI agents from partners like Microsoft, Google, and Adobe, custom workflows built with the Now Assist Skill Kit, and cross-platform orchestration — but in practice, does a policy defined in AI Control Tower enforce the same guardrails on, say, a Microsoft Copilot agent as it does on a Now Assist agent? Or are third-party agents effectively "read-only" from a policy enforcement standpoint? 

3. What's the role of AI Agent Fabric in governance specifically? AI Agent Fabric incorporates emerging industry standards for inter-agent communication, including Model Context Protocol (MCP) and Google's Agent2Agent protocol. Does an agent need to be connected via AI Agent Fabric to be governable inside AI Control Tower, or can agents be governed without being orchestrated through Fabric? 

4. How does human oversight get assigned? AI Control Tower allows customers to assign human managers to oversee agent work. Is this assignment done at the agent level, the workflow level, or the task level? And does the platform support escalation rules when an agent goes outside defined guardrails?

5. How does compliance monitoring work across the AI lifecycle for third-party tools? The platform includes embedded GRC capabilities to proactively manage risk, including security and privacy, and monitor compliance across the AI lifecycle. Does this extend to third-party agents that may be processing data outside the ServiceNow boundary — for example, a Copilot agent calling external APIs? 

Would love to hear from anyone who has hands-on experience with AI Control Tower in a multi-vendor AI environment. Especially curious whether there are documented limitations for third-party agent governance that aren't covered in the marketing materials.

Thanks in advance!