--- sourceDocument: Australia Build or modify applications sourceDocumentLink: https://www.servicenow.com/docs/r/application-development Release : - australia ft:locale : - en-US ft:publication_title : - Australia Build or modify applications ft:clusterId : - cadev bundleId : - cadev workflow : - Development, Data, and Analytics --- # Governance # Governance for agentic development {#ariaid-title1} * Release version: Australia * * Updated June 5, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Governance for agentic development Agentic development on the ServiceNow AI Platform accelerates application creation by generating code and configurations from natural language prompts. To ensure that speed does not compromise security, compliance, and maintainability, governance is embedded directly into the development workflow. This guarantees AI-generated applications meet enterprise standards by default, including risk management, quality assurance, and lifecycle visibility. Show full answer Show less ## Key Features * **Built-in Security and Compliance:** The Build Agent automatically creates Access Control Lists (ACLs), validates scripts for vulnerabilities, and optimizes code during generation. Every AI-generated app includes audit trails, security controls, and compliance checks without extra effort. * **Integrated Governance Workflow:** Governance is part of the scoped application environment, with platform controls such as ACLs, update sets, and application scope boundaries enforced from the start. Tools connect these controls to review and approval workflows. * **Human Review Responsibilities:** Automated testing and validation catch many issues, but human review is required when apps access sensitive data, include scripts or integrations, modify roles or ACLs, or lack testing against specific organizational data. * **AI Control Tower Integration:** AI-generated apps and agents are registered as AI assets in AI Control Tower to track lifecycle status, review security posture, and assess compliance. Risk classification and regulatory evaluation (e.g., NIST AI Risk Management Framework, EU AI Act) are available for governance transparency. * **Core Governance Principles:** Use App Engine Management Center (AEMC) for app approvals and collaborator management; apply controlled release practices with ReleaseOps and metadata pipelines; enforce secure development with ACLs and cross-scope privileges; perform functional and regression testing with Automated Test Framework (ATF); and isolate work in Developer Sandboxes. ## Practical Guidance for ServiceNow Customers * Ensure app ideas are approved in AEMC before development begins. * Leverage Build Agent capabilities to embed security, optimize code, and automatically resolve ATF test failures. * Perform human reviews especially for apps handling sensitive or regulated data, or modifying security roles and access controls. * Use AI Control Tower to monitor AI-generated assets' compliance, security health, and lifecycle progression from development through production. * Adopt ReleaseOps and Developer Sandboxes to manage version control and isolate development safely. * Incorporate governance requirements directly in your natural language prompts to ensure generated apps align with organizational policies from the start. ## Governance Checklist for AI-Generated Apps * App idea approved in AEMC. * Access controls and security roles properly applied. * Code reviewed, optimized, and security validated. * Automated Test Framework (ATF) tests executed and passed. * Release pipeline verified and functioning. * Documentation such as summaries and flow explainers generated. * Compliance and audit logs updated and maintained. ## Governance Tools and Resources * **App Engine Management Center:** Central hub for governance approvals and monitoring. * **AI Control Tower:** Tracks AI agent behavior, security posture, and compliance metrics. * **ServiceNow Vault:** Protects sensitive data across workflows. * **ReleaseOps Toolkit:** Automates update sets and deployment pipelines. * **Automated Test Framework (ATF):** Supports functional and regression testing. * **Developer Sandboxes:** Provides isolated, secure environments for development and experimentation. * **Knowledge Base Articles:** Offer guidelines on data handling and AI usage. Agentic development on the ServiceNow AI Platform accelerates application development by using AI to generate code and configurations from natural language prompts. However, speed must not compromise security, compliance, and maintainability. Governance addresses the following: * Risk and compliance: AI-generated apps meet enterprise security standards and regulatory requirements. * Quality assurance: Automated code is validated through testing and review. * Visibility and control: Prevents shadow IT and enforces lifecycle transparency. {#vc-governance__ul_t5g_51g_phc} ServiceNow embeds security and governance directly into the agentic development workflow, so AI-generated applications meet enterprise standards by default. Build Agent automatically generates Access Control Lists (ACLs) that enforce role-based access, validates scripts for security vulnerabilities, and applies code optimization during generation. Every app that's developed agentically on the ServiceNow AI Platform includes audit trails, security controls, and compliance checks without requiring explicit prompts for these features. Note: Build Agent requires the admin role. ## Governance in an agentic development workflow {#vc-governance__section_vc_governance_why} AI-generated code and configurations can be produced faster than traditional development cycles, which compresses the window for review. When you describe an outcome and the AI generates the implementation, the resulting code, scripts, business rules, and access control configurations may not be immediately visible to the developer who prompted them. Governance practices fill that gap by making the outputs of agentic development auditable, testable, and aligned with organizational policy before apps reach production. Apps built through agentic development on the ServiceNow AI Platform are scoped applications and inherit the same platform controls as any other scoped app, including ACLs, update sets, and application scope boundaries. This means governance is not an additional layer applied after the fact, but part of the development environment from the start. The tools listed in this topic connect those controls to a review and approval workflow. ## Human review responsibilities {#vc-governance__section_vc_governance_human_review} Automated checks in the agentic development workflow, including ATF tests, security scans, and compliance validation, catch many issues before deployment. However, some decisions require human judgment that automated tools cannot replace. Review AI-generated output directly before deployment when any of the following are true. * The app accesses sensitive tables, personally identifiable information, or regulated data. * The app includes scripts, business rules, or integrations with external systems. * The app creates or modifies roles, ACLs, or cross-scope privilege records. * The generated output has not been tested against your organization's specific data or configuration. {#vc-governance__ul_vc_human_review} For apps generated by Build Agent, check the session summary and any generated documentation to understand what was built before promoting the app from a sandbox to a higher environment. Use AEMC to require approvals at key lifecycle stages. ## Governing apps built with AI Control Tower {#vc-governance__section_vc_aict} Apps and agents generated through agentic development are registered as AI assets in AI Control Tower, where AI stewards can track lifecycle progression, review security posture, and assess compliance from a single workspace. Registration happens as part of the development process, so governance visibility is established before an app reaches production. From the AI asset record in AI Control Tower, stewards can see governance health, evaluation scores, and risk classification for each generated app or agent. Security considerations specific to AI-generated assets are surfaced automatically, including agents with elevated permissions, agents that experience access-related errors, and agents that have been inactive for more than 90 days but still retain active permissions. If your organization uses AI Risk and Compliance, apps built through agentic development can be evaluated against regulatory frameworks such as the NIST AI Risk Management Framework and the EU Artificial Intelligence Act. Risk classification and compliance posture are available on the Risk and Compliance tab of each AI asset record. For more information, see [AI Control Tower (legacy)](https://www.servicenow.com/docs/access?context=ai-control-tower-landing&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US). ## Core governance principles {#vc-governance__section_oyx_v1g_phc} 1. Approval and oversight: * Use App Engine Management Center (AEMC) to approve app ideas and manage collaborators. * Require governance checkpoints before moving from sandbox in Developer Sandboxes to production. {#vc-governance__ul_n21_x1g_phc} 2. Controlled release management with ReleaseOps implementation practices: * Update sets and update set automation for version control. * Metadata-as-code pipelines for automated deployments. {#vc-governance__ul_p21_x1g_phc} 3. Secure development practices: * Enforce ACLs and role-based access for generated apps, which Build Agent can do. * Validate AI-generated scripts for security vulnerabilities. * Apply code optimization and review before publishing. * Create Cross-Scope Privileges to control which tables, scripts, and resources one scoped application can access from another. Use Cross-Scope Privileges to diagnose and resolve operation not allowed errors between scoped apps. * While creating agents and skills, Build Agent asks which users and roles it should operate as, as well as which users are allowed to access the agents or skills. {#vc-governance__ul_rfg_pzh_53c} 4. Support for testing and validation: * Use Automated Test Framework (ATF) for functional and regression testing. Note: If you're using Build Agent, it automatically updates failing metadata to resolve ATF test failures, without you needing to manually run ATF tests. * Include peer review for critical workflows and integrations. {#vc-governance__ul_r21_x1g_phc} 5. Isolation of work with Developer Sandboxes: * Experiment and develop in Developer Sandboxes to avoid impacting production. * Align with Git-style branching for concurrent development. {#vc-governance__ul_s21_x1g_phc} ## Governance checklist for apps built with AI assistance {#vc-governance__section_vts_kbg_phc} 1. App idea approved in AEMC. 2. ACLs and security roles applied. 3. Code reviewed and optimized. 4. ATF tests executed and passed. 5. Release pipeline validated. 6. Documentation generated (such as summaries and flow explainers). 7. Compliance and audit logs updated. ## Governance tools and resources {#vc-governance__section_yt4_pbg_phc} {#vc-governance__table_governance_tools__entry__3} | Tool | Description | More information | |-|-|-| | App Engine Management Center | Governance hub for approvals and monitoring. | [App Engine Management Center](https://www.servicenow.com/docs/cgyCCV6TvfNnND4r2xUbig "The App Engine Management Center (AEMC) provides an innovative experience for you to manage the full life cycle for custom app development. You can use AEMC to handle application intake, configure pipelines, oversee developer productivity, and view insights about custom applications across your development environments, all in one centralized location.") | | AI Control Tower | Monitors AI agent behavior, enforces guardrails, tracks AI-generated code changes, and provides dashboards showing which apps were created by Build Agent, what data they access, and how they comply with organizational policies. | [AI Control Tower (legacy)](https://www.servicenow.com/docs/access?context=ai-control-tower-landing&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US) | | ServiceNow Vault | Discovers and protects sensitive data across workflows, so AI-generated apps handle confidential information appropriately. | [ServiceNow Vault](https://www.servicenow.com/docs/access?context=servicenow-vault-landing&version=australia&pubname=australia-platform-security&ft:locale=en-US) | | ReleaseOps Toolkit | Update set automation and metadata pipelines. | [ReleaseOps](https://www.servicenow.com/docs/OGg~z86Jvh8RrLkeCibsBA "ReleaseOps automates deployment of changes across your pipeline, increases predictability and reliability of deployments, and reduces the risk of releasing changes to production.") | | Automated Test Framework | Automated testing for ServiceNow apps. | [Automated Test Framework (ATF)](https://www.servicenow.com/docs/4hkh6VNi_eAnyfY91R522Q "The Automated Test Framework (ATF) enables you to create and run automated tests to confirm that your instance works after making a change. For example, after an upgrade, during application development, or when deploying instance configurations with update sets. Review failed test results to identify the changes that caused the failure and the changes that you should review.") | | Developer Sandboxes | Develop in a secure, isolated Developer Sandboxes environment. | [Developer Sandboxes](https://www.servicenow.com/docs/8n5o1hEPYqgl19r~ioAcOw "Developer Sandboxes provide admins and delegated developers the ability to request, access, and manage individual sandboxes on top of the same underlying development instance. Delegated developers can write and merge code and configuration changes without the risk of their changes getting overwritten on the instance mid-development.") | | Knowledge Base articles | Data handling and AI usage guidelines. | [Knowledge Management](https://www.servicenow.com/docs/access?context=knowledge-management&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US) | [Table 1. Tools and resources for governance] {#vc-governance__table_governance_tools} ## Governance general guidelines {#vc-governance__section_avv_wcg_phc} When using agentic development, prompts should not only describe functionality but also embed governance requirements. This helps generated apps comply with security, compliance, and quality standards. See [Example prompts for agentic development](https://www.servicenow.com/docs/aZQFTheHinh6VDNprO136A "Use these example prompts to build data models, implement security, create business rules, and generate user interfaces when building an app with ServiceNow AI Platform agentic development tools.") for example prompts for governance.