--- sourceDocument: Brazil Build or modify applications sourceDocumentLink: https://www.servicenow.com/docs/r/application-development Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Build or modify applications ft:clusterId : - cadev bundleId : - cadev workflow : - Development, Data, and Analytics --- # Governance # Governance for agentic development {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read Agentic development on the ServiceNow AI Platform accelerates application development by using AI to generate code and configurations from natural language prompts. However, speed must not compromise security, compliance, and maintainability. Governance addresses the following: * Risk and compliance: AI-generated apps meet enterprise security standards and regulatory requirements. * Quality assurance: Automated code is validated through testing and review. * Visibility and control: Prevents shadow IT and enforces lifecycle transparency. {#vc-governance__ul_t5g_51g_phc} ServiceNow embeds security and governance directly into the agentic development workflow, so AI-generated applications meet enterprise standards by default. Build Agent automatically generates Access Control Lists (ACLs) that enforce role-based access, validates scripts for security vulnerabilities, and applies code optimization during generation. Every app that's developed agentically on the ServiceNow AI Platform includes audit trails, security controls, and compliance checks without requiring explicit prompts for these features. Note: Build Agent requires the admin role. ## Governance in an agentic development workflow {#vc-governance__section_vc_governance_why} AI-generated code and configurations can be produced faster than traditional development cycles, which compresses the window for review. When you describe an outcome and the AI generates the implementation, the resulting code, scripts, business rules, and access control configurations may not be immediately visible to the developer who prompted them. Governance practices fill that gap by making the outputs of agentic development auditable, testable, and aligned with organizational policy before apps reach production. Apps built through agentic development on the ServiceNow AI Platform are scoped applications and inherit the same platform controls as any other scoped app, including ACLs, update sets, and application scope boundaries. This means governance is not an additional layer applied after the fact, but part of the development environment from the start. The tools listed in this topic connect those controls to a review and approval workflow. ## Human review responsibilities {#vc-governance__section_vc_governance_human_review} Automated checks in the agentic development workflow, including ATF tests, security scans, and compliance validation, catch many issues before deployment. However, some decisions require human judgment that automated tools cannot replace. Review AI-generated output directly before deployment when any of the following are true. * The app accesses sensitive tables, personally identifiable information, or regulated data. * The app includes scripts, business rules, or integrations with external systems. * The app creates or modifies roles, ACLs, or cross-scope privilege records. * The generated output has not been tested against your organization's specific data or configuration. {#vc-governance__ul_vc_human_review} For apps generated by Build Agent, check the session summary and any generated documentation to understand what was built before promoting the app from a sandbox to a higher environment. Use AEMC to require approvals at key lifecycle stages. ## Governing apps built with AI Control Tower {#vc-governance__section_vc_aict} Apps and agents generated through agentic development are registered as AI assets in AI Control Tower, where AI stewards can track lifecycle progression, review security posture, and assess compliance from a single workspace. Registration happens as part of the development process, so governance visibility is established before an app reaches production. From the AI asset record in AI Control Tower, stewards can see governance health, evaluation scores, and risk classification for each generated app or agent. Security considerations specific to AI-generated assets are surfaced automatically, including agents with elevated permissions, agents that experience access-related errors, and agents that have been inactive for more than 90 days but still retain active permissions. If your organization uses AI Risk and Compliance, apps built through agentic development can be evaluated against regulatory frameworks such as the NIST AI Risk Management Framework and the EU Artificial Intelligence Act. Risk classification and compliance posture are available on the Risk and Compliance tab of each AI asset record. For more information, see [AI Control Tower (legacy)](https://www.servicenow.com/docs/access?context=ai-control-tower-landing&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US). ## Core governance principles {#vc-governance__section_oyx_v1g_phc} 1. Approval and oversight: * Use App Engine Management Center (AEMC) to approve app ideas and manage collaborators. * Require governance checkpoints before moving from sandbox in Developer Sandboxes to production. {#vc-governance__ul_n21_x1g_phc} 2. Controlled release management with ReleaseOps implementation practices: * Update sets and update set automation for version control. * Metadata-as-code pipelines for automated deployments. {#vc-governance__ul_p21_x1g_phc} 3. Secure development practices: * Enforce ACLs and role-based access for generated apps, which Build Agent can do. * Validate AI-generated scripts for security vulnerabilities. * Apply code optimization and review before publishing. * Create Cross-Scope Privileges to control which tables, scripts, and resources one scoped application can access from another. Use Cross-Scope Privileges to diagnose and resolve operation not allowed errors between scoped apps. * While creating agents and skills, Build Agent asks which users and roles it should operate as, as well as which users are allowed to access the agents or skills. {#vc-governance__ul_rfg_pzh_53c} 4. Support for testing and validation: * Use Automated Test Framework (ATF) for functional and regression testing. Note: If you're using Build Agent, it automatically updates failing metadata to resolve ATF test failures, without you needing to manually run ATF tests. * Include peer review for critical workflows and integrations. {#vc-governance__ul_r21_x1g_phc} 5. Isolation of work with Developer Sandboxes: * Experiment and develop in Developer Sandboxes to avoid impacting production. * Align with Git-style branching for concurrent development. {#vc-governance__ul_s21_x1g_phc} ## Governance checklist for apps built with AI assistance {#vc-governance__section_vts_kbg_phc} 1. App idea approved in AEMC. 2. ACLs and security roles applied. 3. Code reviewed and optimized. 4. ATF tests executed and passed. 5. Release pipeline validated. 6. Documentation generated (such as summaries and flow explainers). 7. Compliance and audit logs updated. ## Governance tools and resources {#vc-governance__section_yt4_pbg_phc} {#vc-governance__table_governance_tools__entry__3} | Tool | Description | More information | |-|-|-| | App Engine Management Center | Governance hub for approvals and monitoring. | [App Engine Management Center](https://www.servicenow.com/docs/CRVfkpkTu6XRJbPQ0enR9w "The App Engine Management Center (AEMC) provides an innovative experience for you to manage the full life cycle for custom app development. You can use AEMC to handle application intake, configure pipelines, oversee developer productivity, and view insights about custom applications across your development environments, all in one centralized location.") | | AI Control Tower | Monitors AI agent behavior, enforces guardrails, tracks AI-generated code changes, and provides dashboards showing which apps were created by Build Agent, what data they access, and how they comply with organizational policies. | [AI Control Tower (legacy)](https://www.servicenow.com/docs/access?context=ai-control-tower-landing&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US) | | ServiceNow Vault | Discovers and protects sensitive data across workflows, so AI-generated apps handle confidential information appropriately. | [ServiceNow Vault](https://www.servicenow.com/docs/access?context=servicenow-vault-landing&version=brazil&pubname=brazil-platform-security&ft:locale=en-US) | | ReleaseOps Toolkit | Update set automation and metadata pipelines. | [ReleaseOps](https://www.servicenow.com/docs/vZUffktmMgO7OdPVsqzYDA "ReleaseOps automates deployment of changes across your pipeline, increases predictability and reliability of deployments, and reduces the risk of releasing changes to production.") | | Automated Test Framework | Automated testing for ServiceNow apps. | [Automated Test Framework (ATF)](https://www.servicenow.com/docs/xdkKDh1sdsDGQZvrwb5TtQ "The Automated Test Framework (ATF) enables you to create and run automated tests to confirm that your instance works after making a change. For example, after an upgrade, during application development, or when deploying instance configurations with update sets. Review failed test results to identify the changes that caused the failure and the changes that you should review.") | | Developer Sandboxes | Develop in a secure, isolated Developer Sandboxes environment. | [Developer Sandboxes](https://www.servicenow.com/docs/4NKj2TtMxu0NBruxw~pxdA "Developer Sandboxes are isolated development environments on a shared instance. Delegated developers use them to build and merge changes in parallel, and admins request and manage them.") | | Knowledge Base articles | Data handling and AI usage guidelines. | [Knowledge Management](https://www.servicenow.com/docs/access?context=knowledge-management&version=brazil&pubname=brazil-servicenow-platform&ft:locale=en-US) | [Table 1. Tools and resources for governance] {#vc-governance__table_governance_tools} ## Governance general guidelines {#vc-governance__section_avv_wcg_phc} When using agentic development, prompts should not only describe functionality but also embed governance requirements. This helps generated apps comply with security, compliance, and quality standards. See [Example prompts for agentic development](https://www.servicenow.com/docs/d2z0wqzXMF3YBAceAaOZXA "Use these example prompts to build data models, implement security, create business rules, and generate user interfaces when building an app with ServiceNow AI Platform agentic development tools.") for example prompts for governance.