AI Guardian FAQ

[michaelmalc]

AI Guardian was formerly named Now Assist Guardian. Last updated Q3 2026.

Overview

What is AI Guardian?

AI Guardian is a built-in platform component that ships with the Generative AI Controller and is key to ServiceNow’s Secure and Responsible AI approach. It assesses AI risks, undesired behaviors, and dangerous platform usage such as offensiveness and prompt injection.

It is a suite of models and methods built into the ServiceNow AI Platform and included with ServiceNow Otto through the Generative AI Controller. It also helps mitigate security and privacy threats, such as prompt injection attacks and adversarial requests.

AI Guardian is a key platform enabler for Responsible AI, following our principles of human centricity, diversity, transparency, and accountability. See the product documentation for more information.

What does AI Guardian do?

AI Guardian evaluates undesired generative AI model behaviors to help mitigate risk. It is a service that enables other ServiceNow Otto applications to detect and handle inappropriate LLM outputs and usage.

PII is closely related, but not exclusive, to AI risk. PII handling for generative AI is managed separately through Data Privacy for Now Assist, which de-identifies sensitive data in prompts before they reach the LLM and restores the original values in the response.

What guardrails are available?

AI Guardian includes three guardrails: offensiveness detection, prompt injection (security) detection, and sensitive topic filters. Sensitive topic filters are available for ServiceNow Otto for HR Service Delivery and ServiceNow Otto for Customer Service Management.

Were there controls for offensiveness and prompt injection before AI Guardian?

Yes. AI Guardian is an additional layer on top of our existing model fine-tuning and alignment. It also makes these issues and attempts visible to customers through logging.

Defaults and configuration

Are guardrails turned on by default?

It depends on the guardrail.

Prompt injection: On by default for all AI skills except ServiceNow Otto for Platform skills and custom skills, which admins configure manually. The default action is block and log, at a medium severity threshold.

Offensiveness: Off by default. Admins turn it on per workflow.

Sensitive topic filters: Require admin activation and configuration.

Admins can change each guardrail’s action (block or log) and sensitivity threshold. Because LLM-based detection can produce false positives, such as blocking output that isn’t offensive, we recommend testing with a small group of stakeholders before changing a default. You can also run detection in log-only mode to monitor without affecting the user experience, then move to blocking if monitoring shows an issue.

Can I configure AI Guardian per skill?

Partly. The offensiveness guardrail is configured per workflow, such as CSM, HRSD, and ITSM. Prompt injection detection can be configured at the instance level and for individual skills. Starting with the Brazil release, when a skill has its own setting, AI Guardian applies whichever setting is more protective. Sensitive topic filters are available for ServiceNow Otto for HR Service Delivery and ServiceNow Otto for Customer Service Management.

What configuration options do I have?

All guardrails are configured in the Now Assist Admin Console.

Offensiveness: Choose to log the output, which records the detection (including the request, conversation, and any user feedback) while agents still see the content. Or choose to block the response and log the output, which stops the content from displaying and shows a standard error message.

Prompt injection: Configure at the instance level and, optionally, per skill. Logging the output is the instance-level default: it records the detection and keeps the model response visible. Blocking the response and logging the output is the default for AI skills, except ServiceNow Otto for Platform skills and custom skills: it stops the content from being generated and shows a standard error message.

Sensitive topic filters: Modify out-of-the-box filters and add, edit, or delete sample phrases. Filters apply to ServiceNow Otto for Virtual Agent conversations in HR Service Delivery and Customer Service Management, and redirect the conversation to a live agent or case when a match is detected.

Severity: For offensiveness and prompt injection, choose Low, Medium, or High to control how aggressively each guardrail flags content.

Does AI Guardian work with any LLM?

Yes. AI Guardian is integrated with the Generative AI Controller, so it applies whether you use the Now LLM Service or a supported Bring Your Own LLM (BYOL) provider, such as Azure OpenAI, AWS Anthropic Claude, or Google Gemini.

You can also choose which guardrail provider powers detection (ServiceNow Guardrail, Azure Content Safety, Amazon Bedrock Guardrails, or Google Model Armor), independent of the LLM provider in use.

How detection works

How does AI Guardian detect offensive content, prompt injection, and sensitive topics?

AI Guardian assesses the input and output of models used for AI skills. Depending on configuration, it logs or blocks offensive content, prompt injection attempts, or sensitive subjects. The user experience varies by use case, based on the risk of displaying the content.

Can agents override a guardrail?

No. When blocking is on for offensiveness or prompt injection, the agent sees a standard error message and never sees the generated content.

Does AI Guardian add latency?

AI Guardian checks content against configured guardrails in parallel with, or in sequence after, the LLM call. In log mode, it records its findings and the user receives the skill output. In block mode, it records its findings and blocks the output within the instance. Customers should not see noticeable latency.

Which languages does AI Guardian support?

AI Guardian supports ServiceNow’s P1 languages (English, French, German, Italian, Spanish, Brazilian Portuguese) and P2 languages (Canadian French, Japanese, Dutch). See Multilingual support for ServiceNow generative AI products.

Is there guidance on how evaluations account for regional differences in what’s considered offensive?

Not currently. We do not have a guide on how evaluations are weighted for one region or culture versus another.

Which AI Guardian metrics appear in model cards?

F1, Precision, Recall, Correctness, and False Positive Rate (FPR). See the model card for current metrics.

Offensiveness guardrail

What does the offensiveness guardrail check for?

The model is trained on 16 safety categories. When the guardrail detects offensive content, the category ID appears in the logs.

Category ID	Category	Description
O1	Toxic Content	Should not: Promote hate speech, incite violence like child abuse or bullying, or engage in personal attacks or harassment. Can: Discuss the impacts and societal issues related to toxic content for educational purposes.
O2	Unfair Representation	Should not: Assist in perpetuating stereotypes or encourage discrimination or bias. Can: Discuss issues of representation and promote awareness and inclusivity.
O3	Adult Content	Should not: Display sexually explicit material or content inappropriate for minors, including pornography, erotic chat, and sexual activity. Can: Offer educational discussions on topics related to sexuality and consent.
O4	Erosion of Trust in Public Information	Should not: Spread misinformation or disinformation undermining public trust, such as misleading medical advice, illegal drugs, and advice. Can: Critically analyze misinformation trends and educate about media literacy.
O5	Propagating Misconceptions/False Beliefs	Should not: Disseminate unverified, misleading information, conspiracy theories, science denialism, historical revisionism, or content that could lead to radicalization. Can: Provide critical analysis and debunking of common misconceptions and false beliefs.
O6	Risky Financial Practices	Should not: Promote unethical trade practices such as multi-level marketing, deceptive lending practices, or gambling. Can: Educate about associated risks, ethical lending, responsible gambling, trade compliance, and fair business practices.
O7	Trade and Compliance	Should not: Involve labor issues, engage in unethical trade affairs, contribute to unfair labor practices, or promote fraudulent trade practices. Can: Provide information and insights into labor issues, ethical trade practices, trade compliance, and fair business conduct.
O8	Dissemination of Dangerous Information	Should not: Spread fake news, propagate social media rumors, disclose government secrets, or leak financial data and other content that contributes to public panic or national security concerns. Can: Educate about the dangers of such information and promote safety.
O9	Privacy Infringement	Should not: Involve doxxing, unauthorized data sharing, or surveillance like inferring or leaking private information. Can: Discuss the importance of privacy rights and digital security.
O10	Security Threats	Should not: Spread malware or encourage terrorism or other security threats such as weapon generation, cyber attacks, or chemical harms. Can: Provide information and methods to identify and mitigate security threats.
O11	Defamation	Should not: Publish false statements damaging to individuals, groups, or organizations. Can: Explore the legal and ethical aspects of defamation and free speech.
O12	Fraud or Deceptive Action	Should not: Engage in academic dishonesty, perpetrate scams, promote pseudo-pharmaceuticals, or disseminate fake online content. Content should not deceive or defraud individuals. Can: Educate about recognizing and preventing fraudulent activities.
O13	Influence Operations	Should not: Manipulate public opinion or disrupt societal harmony for political or ideological purposes, like surveillance or campaigns. Can: Analyze and educate about the nature and impact of influence operations.
O14	Illegal Activities	Should not: Promote or provide guidance on engaging in illegal actions like crimes or terrorism. Can: Educate about the consequences and prevention of illegal activities.
O15	Persuasion and Manipulation	Should not: Involve persuasion or manipulation techniques that promote self-harm, psychological manipulation, or any form of harm to individuals’ well-being. Can: Educate about recognizing and resisting manipulation, and offer support and resources for those affected.
O16	Violation of Personal Property	Should not: Violate an individual’s personal property, including malicious mimicking, plagiarism, copyright infringement, and forging identity. Can: Promote awareness and discussions on respecting personal property and preventing such violations.

Can I add my own offensiveness categories?

Not to ServiceNow Guardrail’s 16 built-in categories. With Bring Your Own Key (BYOK), you can apply your existing hyperscaler guardrail configurations, including custom filters and blocklists. You can also connect your own guardrail provider with Bring Your Own Guardrails.

Sensitive topic filters

Can I create custom sensitive topic filters?

Yes. Add sample phrases in the setup dialog for a filter, or directly in the sys_gen_ai_filter_sample table. This applies to Virtual Agent conversations in HR Service Delivery and Customer Service Management.

How do sample phrases affect detection?

Sample phrases help the AI recognize the many ways people phrase the same request. For example, if a user says “unlock my account” but the filter only includes “reset password,” it may not match. Adding variations makes it more likely the request is routed to the correct filter topic.

Why add more sample phrases?

The more sample phrases you provide, the more accurately the filters catch these topics.

Is there a limit on sample phrases?

There is no official maximum. In engineering testing, the Now Assist Admin Console slowed down at around 800 phrases. If you need more than 800, open a Support case.

Logs and monitoring

Where can I find guardrail logs?

Go to Now Assist Admin > Settings > AI Guardian. Logs include the request, the conversation, and any user feedback. You can also export each guardrail’s logs to CSV from the Now Assist Admin Console for deeper analysis, including users, timestamps, and prompts.

Does AI Guardian notify a manager when an employee is offensive?

No, there is no automated manager notification today.

How does ServiceNow use evaluation results?

If a customer has opted in to data sharing, we use Filtered AI Content to review model performance in real-world scenarios.

Data and privacy

Does opting out of data sharing also opt out of AI Guardian?

No. You can opt out of the Advanced AI & Data Terms data-sharing program without affecting AI Guardian. AI Guardian operates in two modes: inference, where the LLM provides a prompt and response, and monitoring, which uses data from a 30-day retention log table in your instance.

Is AI Guardian optional if I don’t want data processed in ServiceNow regional data centers?

Yes. You can leave guardrails off, with one exception: prompt injection detection is on by default for AI skills (see Are guardrails turned on by default?). You can also run detection through a different guardrail provider (Azure Content Safety, Amazon Bedrock Guardrails, or Google Model Armor) instead of the Now LLM Service, or connect your own with Bring Your Own Guardrails.

Licensing

Does AI Guardian consume extra assists?

No. It is included in ServiceNow Otto licensing at no additional cost.

Am I charged when AI Guardian blocks a response?

No. When AI Guardian blocks an AI skill’s content, you are not charged the assist for that skill.