--- sourceDocument: Australia Enable AI sourceDocumentLink: https://www.servicenow.com/docs/r/australia/intelligent-experiences Release : - australia ft:locale : - en-US ft:publication_title : - Australia Enable AI ft:clusterId : - platai bundleId : - platai workflow : - Platform --- # Configuring security connections # Configuring security connections {#ariaid-title1} Release version: Australia Updated July 29, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Configuring security connections This guide explains how to configure security connections in AI Control Tower to manage and contain AI agents across various hosting platforms and identity providers. By establishing these connections, ServiceNow customers can enforce policies and use kill switch protocols to deactivate AI agents wherever they are running, enhancing security and control. Show full answer Show less ## Key Features * **Supports multiple AI agent platforms:** Connect AI Control Tower to Agent Client Collector (ACC), AWS Bedrock, AWS Bedrock Agent Core, Gemini Enterprise Agent Platform, Azure AI Foundry, and ServiceNow Agents. * **Identity provider integration:** Use Okta to federate AI agent identities, enabling containment actions to prevent token issuance upon agent deactivation. * **Deny Resource policy enforcement:** On supported hyperscaler platforms (AWS, Gemini, ServiceNow), deactivating an AI agent applies a Deny Resource policy directly on the platform for immediate containment. * **Azure AI Foundry-specific enforcement:** Deactivation disables the agent application via Azure Resource Manager API instead of a Deny Resource policy. * **Multiple authentication models:** Connections use access keys (AWS), OAuth 2.0 JWT Bearer (Gemini), Azure AD app registration (Azure AI Foundry), and API keys (Okta), ensuring secure authentication tailored to each platform. * **Agent Client Collector (ACC) integration:** Enables blocking or unblocking AI usage on managed devices as a control enforcement point. ## Practical Implementation for ServiceNow Customers * **Adding connections:** Follow platform-specific procedures to add AWS Bedrock/Core, Azure AI Foundry, Gemini Enterprise Agent Platform, Okta, or ACC connections to AI Control Tower. * **Federated identities with Okta:** Enhances containment by preventing future token issuance to deactivated agents, applicable for ServiceNow, AWS Bedrock, and Gemini agents. * **Unique agent identities:** For Gemini Enterprise Agent Platform, ensure agents have unique identities configured to support containment. ## Key Outcomes * Centralized control of AI agents across multiple platforms through AI Control Tower. * Robust security enforcement using kill switch protocols and Deny Resource policies or direct application disables. * Improved containment by integrating identity providers like Okta to prevent unauthorized agent reactivation. * Enables proactive management of AI agent activity on managed devices via ACC. Connect AI Control Tower to the platforms where your AI agents run and to your identity provider so that policies and AI agent containment using kill switch protocol can act on agents wherever they're hosted. ## Key benefits {#aict-configuring-security-connections__section_security_key_benefits} * Connect AI Control Tower to these platforms that host your AI agents: Agent Client Collector (ACC), AWS Bedrock, AWS Bedrock Agent Core, Gemini Enterprise Agent Platform, Azure AI Foundry, and ServiceNow Agents. Also, you can use Okta as an identity provider, so policy and containment actions can reach agents no matter where they run. * Deactivate an AI agent through Deny Resource policies applied directly on the hyperscaler platform, without requiring a separate identity provider connection. * Add an Okta connection to strengthen containment: when an agent's identity is federated through Okta, deactivating the agent also prevents future tokens from being issued to it. {#aict-configuring-security-connections__ul_security_key_benefits} ## Security connections and AI agent containment {#aict-configuring-security-connections__section_security_connections_and_containment} A security connection authenticates AI Control Tower to the platform or identity provider where an AI agent runs, so that policies and AI agent containment using kill switch protocol can act on that agent. Each connector uses a different authentication model --- access key credentials for AWS Bedrock and AWS Bedrock Agent Core, OAuth 2.0 with a JWT Bearer grant for Gemini Enterprise Agent Platform, an Azure AD app registration for Azure AI Foundry, and an API key for Okta --- but every connector ultimately creates a security connector record that appears under the Established connections tab. Behind the scenes, AI agent containment is enforced differently depending on which connections you have in place: * On a supported hyperscaler platform (AWS, Gemini Enterprise Agent Platform, and ServiceNow), deactivating an AI agent using kill switch protocol applies a Deny Resource policy directly on that platform. This alone is enough to fully disable the agent. * On Azure AI Foundry, deactivating an AI agent using kill switch protocol disables the agent application directly through the Azure Resource Manager API, rather than applying a Deny Resource policy. * If you also add an Okta connection, and the AI agent's identity is federated through Okta (AWS Bedrock, AWS Bedrock Agent Core, Gemini Enterprise Agent Platform, and ServiceNow Agents), deactivating the agent additionally prevents future tokens from being assigned to it. Important: AI agent containment for Gemini Enterprise Agent Platform agents is supported only for agents that have a unique agent identity configured. See [Add a Gemini Enterprise Agent Platform connection](https://www.servicenow.com/docs/4CndOWe6jLDnuZS8XSpHog "Connect Gemini Enterprise Agent Platform to AI Control Tower using a service account and OAuth 2.0 JWT Bearer authentication, so policies and AI agent containment using kill switch protocol can reach and act on agents running on Gemini Enterprise Agent Platform."). * **[Add an AWS Bedrock or AWS Bedrock Agent Core connection](https://www.servicenow.com/docs/emw896JLJlQxis2wqzUMug)** Connect AWS Bedrock or AWS Bedrock Agent Core to AI Control Tower so policies and AI agent containment using kill switch protocol can reach and act on agents running on AWS. * **[Add an Azure AI Foundry connection](https://www.servicenow.com/docs/hVsMRrOsj9957~u9VyxhEw)** Connect Azure AI Foundry to AI Control Tower so that policies and AI agent containment using kill switch protocol can reach and act on agents running on Azure AI Foundry. * **[Add a Gemini Enterprise Agent Platform connection](https://www.servicenow.com/docs/4CndOWe6jLDnuZS8XSpHog)** Connect Gemini Enterprise Agent Platform to AI Control Tower using a service account and OAuth 2.0 JWT Bearer authentication, so policies and AI agent containment using kill switch protocol can reach and act on agents running on Gemini Enterprise Agent Platform. * **[Add an Okta connection](https://www.servicenow.com/docs/eevqkGm8fyzEEplaLQNW8Q)** Connect Okta to AI Control Tower so that policies and AI agent containment with kill switch protocol prevent future tokens from being issued to a deactivated AI agent. If your AI agent is on ServiceNow or AWS Bedrock, the agent's identity is federated through Okta. * **[Add an Agent Client Collector (ACC) connection](https://www.servicenow.com/docs/sTmXNjm_yQGa8g3VerIs_A)** Block and unblock AI usage on managed devices by configuring Agent Client Collector (ACC) as a control enforcement point.