--- sourceDocument: Australia Build or modify applications sourceDocumentLink: https://www.servicenow.com/docs/r/application-development Release : - australia ft:locale : - en-US ft:publication_title : - Australia Build or modify applications ft:clusterId : - cadev bundleId : - cadev workflow : - Development, Data, and Analytics --- # Governance # Build Agent governance {#ariaid-title1} * Release version: Australia * * Updated July 24, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Build Agent governance Build Agent governance provides automated safeguards that enhance code quality, security, and compliance for applications generated using Build Agent on the ServiceNow AI Platform®. It ensures AI-generated apps adhere to enterprise security standards, regulatory requirements, and organizational policies by integrating governance from AI Control Tower and App Engine Management Center. This governance framework helps monitor agents, manage application lifecycles, and enforce policies effectively. Show full answer Show less ## Key Features * **Automated Security Controls:** Build Agent automatically generates Access Control Lists (ACLs), validates scripts for security vulnerabilities, and applies code optimization during app generation. * **Comprehensive Security Metadata Support:** Supports ACLs, roles, Security Attributes (for attribute-based access control), and Security Data Filters (for row-level data restrictions), enabling layered and fine-grained access control within applications. * **Cross-Scope Privileges:** Build Agent creates privilege records to manage access between scoped applications, preventing "operation not allowed" errors and facilitating smooth inter-app interactions. * **Background Script Containment:** Scripts require approval before execution, run within defined scopes, and offer an on-demand rollback feature to revert changes if needed, ensuring controlled and safe script execution. * **Custom Skills and Rules:** Administrators can configure custom skills and rules to enforce organizational standards and guide Build Agent behavior consistently across development sessions. * **Integration with AI Control Tower:** Agents generated by Build Agent are registered as AI assets, allowing AI stewards to track lifecycle progression, monitor security posture, assess compliance, and visualize dependencies through an access map. * **Risk and Compliance Evaluation:** When integrated with AI Risk and Compliance, generated agents are evaluated against frameworks such as the NIST AI Risk Management Framework and the EU Artificial Intelligence Act, with risk classification surfaced in AI asset records. ## Key Outcomes * Enterprise-grade security and compliance assurance for AI-generated applications without manual intervention. * Prevention of shadow IT by enforcing role-based access and lifecycle transparency. * Improved visibility and control over AI agents and applications via centralized governance tools. * Reduced operational risks through automated script validation, approval workflows, and rollback capabilities. * Enhanced ability for AI stewards to proactively manage AI assets and assess their security and compliance posture within the ServiceNow environment. Governance controls in Build Agent help with code quality, security, and compliance when generating applications. The Build Agent automated safeguards prevent common development issues and enforce organizational standards. Every app and AI agent generated with Build Agent inherits the governance of AI Control Tower and App Engine Management Center, plus the same identity framework as the rest of the ServiceNow AI Platform®. Use the governance tools to monitor agents, manage app lifecycle, and enforce policy. Governance addresses the following: * Risk and compliance: AI-generated apps meet enterprise security standards and regulatory requirements. * Quality assurance: Automated code is validated through testing and review. * Visibility and control: Prevents shadow IT and enforces lifecycle transparency. {#build-agent-governance__ul_t5g_51g_phc} Build Agent automatically generates Access Control Lists (ACLs) that enforce role-based access, validates scripts for security vulnerabilities, and applies code optimization during generation. Every app that's developed agentically on the ServiceNow AI Platform includes audit trails, security controls, and compliance checks without requiring explicit prompts for these features. Build Agent supports the full set of native ServiceNow security controls, not only ACLs and roles. For example, Build Agent can create Security Attributes for attribute-based access control and Security Data Filters for row-level data restriction. * Security Attributes control access based on properties assigned to users and resources, instead of role membership alone. For more information on Security Attributes, see [Security Attributes](https://www.servicenow.com/docs/access?context=security-attributes-landing&version=australia&pubname=australia-platform-security&ft:locale=en-US). * Security Data Filters restrict which rows a user can see on a table, for example, so that managers see only their team's records. {#build-agent-governance__ul_d5l_2sj_2jc}All four security metadata types can be combined in a single application for layered access control. Some ways that Build Agent enforces governance include: * Enforce ACLs and role-based access for generated apps, which Build Agent can do. * Validate AI-generated scripts for security vulnerabilities. * Apply code optimization and review before publishing. * Create Cross-Scope Privileges to control which tables, scripts, and resources one scoped application can access from another. Use Cross-Scope Privileges to diagnose and resolve operation not allowed errors between scoped apps. * While creating agents and skills, Build Agent asks which users and roles it should operate as, as well as which users are allowed to access the agents or skills. {#build-agent-governance__ul_xph_rzh_53c} ## AI Control Tower {#build-agent-governance__section_ai_control_tower} Agents generated by Build Agent are registered as AI assets in AI Control Tower, where AI stewards can track lifecycle progression, monitor security posture, and assess compliance. From the AI asset record, stewards can review governance health, evaluation scores, and risk classification for each agent without leaving the workspace. AI Control Tower identifies specific security considerations for generated agents, including the following: * Agents with elevated permissions * Agents that experience access-related errors * Agents that have been inactive for more than 90 days but still retain active permissions The access map visualizes relationships between agents, agentic workflows, and the tools they use, which helps stewards assess dependencies and potential impact before making changes. If your organization uses AI Risk and Compliance, generated agents can be evaluated against organizational policies and regulatory frameworks. For example, the NIST AI Risk Management Framework and the EU Artificial Intelligence Act. Risk classification and compliance posture are surfaced on the Risk and Compliance tab of each AI asset record. For more information, see [AI Control Tower (legacy)](https://www.servicenow.com/docs/access?context=ai-control-tower-landing&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US). For more information on governance, agentic development and other ServiceNow development tools, see [Governance for agentic development](https://www.servicenow.com/docs/aPE4Rrm81N5Z1oSmvzr0Bg "Agentic development on the ServiceNow AI Platform accelerates application development by using AI to generate code and configurations from natural language prompts. However, speed must not compromise security, compliance, and maintainability."). ## Cross-scope privileges {#build-agent-governance__section_cross-scope-privileges} Build Agent can create Cross-Scope Privilege records to control which tables, scripts, and resources one scoped application can access from another. If a scoped app needs to read a table or call a script include from a different scope, Build Agent generates the appropriate privilege records. Cross-Scope Privileges are also useful for diagnosing and resolving operation not allowed errors between scoped apps. ## Background script containment {#build-agent-governance__section_background-script-containment} When Build Agent runs a background script using one of the script tools, several containment controls limit the impact of server-side execution. Approval before execution : Build Agent requires you to approve every script run before it executes. The approval prompt shows the generated script, its stated intent, and the target application scope so you can review the operation before it runs. Scope restriction : Scripts run in the scope of the app being built by default. You can specify a different scope by name. If the scope name can't be resolved, the run fails rather than executing in the global scope. On-demand rollback : After a script runs, Build Agent returns a rollback context you can use to revert the operation. Rollback requires the same approval step as the original run. Only scripts run by Build Agent can be reverted using this mechanism. For more information on using the script tools, see [Build Agent tools](https://www.servicenow.com/docs/VQrxEeVCuGXA8Ccbf18sTg "Build Agent tools support application development tasks such as semantic search, schema inspection, code search, planning, UI validation, database querying, app navigation, and script execution. Each tool extends what Build Agent can do during a build session."). ## Custom skills and rules {#build-agent-governance__section_custom-skills-rules} Admins can define custom skills and rules to enforce organizational standards and guide Build Agent behavior across sessions. Rules apply automatically to every session at the configured scope. Skills provide on-demand guidance that Build Agent can draw on when needed. For more information, see [Configure custom skills and rules](https://www.servicenow.com/docs/LtRpDHZkp~kmMTLlM624KQ "Create and manage custom skills and rules, or instructions to control how Build Agent behaves during a session. Rules are preloaded into every session automatically. Skills are available on demand when you or the agent invokes them by name.").