---
sourceDocument: Australia Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/intelligent-experiences

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Action approval flow in ServiceNow Arc

# Action approval flow in ServiceNow Arc {#ariaid-title1}

Release version: Australia  
Updated October 23, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 7 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Action approval flow in ServiceNow Arc

ServiceNow Arc uses a structured approval flow to determine whether actions initiated through its tools run immediately, require user approval, or are blocked.
This flow incorporates three main controls: tool gates, approval patterns, and auto approval.
These controls ensure that actions comply with organizational policies, maintaining security and operational integrity.
Show full answer Show less  

## Tool Gates

Tool gates define how Arc handles actions for each tool with four modes:

* **Allow:** Runs the action without any approval checks.
* **Deny:** Blocks the action completely with no approval option.
* **Require approval:** Sends the action to approval patterns and prompts the user if needed.
* **Auto approval:** Uses an AI model reviewer to approve actions automatically, except for those under hard gates which always prompt the user. This mode requires the auto approval capability to be enabled and the user's chat to be in auto mode.

If no tool gate is defined, the tool is treated as requiring approval.

## Approval Patterns

Approval patterns specify which commands need user decisions. They apply to tools with gates requiring approval or auto approval, or those without a gate. Patterns match commands through three modes:

* **Exact:** Literal strings or regular expressions for precise matches.
* **Relaxed:** Key words in order, allowing for variations.
* **Keyword:** Presence of specific write verbs indicating data modification.

Each pattern has a gate type:

* **Hard gate:** Always prompts the user, no saved approvals.
* **Soft gate:** Prompts the user, who can save approvals for repeated actions.
* **Allow carve-out:** Runs the command without prompting, as an exception.

Default policies apply hard gates to sensitive or destructive commands and soft gates to routine, low-impact operations.

## Auto Approval

When enabled, auto approval uses an AI model reviewer to evaluate non-hard gate actions. Actions deemed destructive, irreversible, or externally visible are escalated to the user for approval. If the model is unavailable or uncertain, Arc defaults to prompting the user. This capability reduces prompts for trusted actions while preserving human oversight for sensitive changes.

## User Experience

Users see an approval card when an action requires approval, with options to Allow or Always Allow (for soft gates). Choosing Always Allow saves the decision for similar future actions, streamlining workflows. Users can manage saved approvals in the settings. Actions modifying files outside the workspace but within the home folder also trigger approval requests, subject to policy rules.

## Built-in Protections

Certain critical checks always require user approval regardless of gate settings, including:

* Commands affecting sensitive files like credentials or keys.
* Commands writing to locations where code execution is automatic (e.g., scheduled tasks, specific macOS folders).
* Commands modifying environment variables that affect program loading.
* Commands attempting to read or change Arc's own configuration files are blocked outright.

Additional safety checks apply for shell commands involving file redirects or unsafe piping unless the tool gate is set to allow or auto approval.

## Practical Benefits for ServiceNow Customers

* Granular control over action execution enhances security and compliance.
* Flexible gating and approval pattern configuration tailor approvals to organizational risk tolerance.
* Auto approval reduces manual prompts, improving efficiency while maintaining oversight.
* Users have clear visibility and control over approvals, with options to save decisions for repetitive tasks.
* Built-in protections guard against unintended or malicious modifications to sensitive system areas.  
Tool gates, approval patterns, and auto approval decide whether each action Arc attempts runs, waits for a person's approval, or is blocked.

Three controls decide whether an action runs. Tool gates set how Arc handles each tool. Approval patterns identify the commands that need a person's decision. Auto approval lets an AI model reviewer approve some actions without prompting the user.
Figure 1. Action evaluation flow in Arc

Every action passes through these controls in the following order:

1. Arc checks for an active policy. If no active policy is available, Arc refuses the action.
2. Arc applies the tool gate for the tool. An allow gate runs the action without checking approval patterns, and a deny gate blocks it. A gate that requires approval sends the action to approval patterns, and so does a tool with no gate. An auto approval gate sends it to auto approval.
3. When approval patterns apply, Arc compares the command against them. If no pattern matches, the action runs. A hard gate match prompts the user. A soft gate match runs the action when a saved approval exists and prompts the user otherwise. An allow carve-out match runs the action without a prompt.
4. Under auto approval, Arc prompts the user if the action is under a hard gate. Otherwise, the model reviewer approves the action or escalates it to the user.
5. When prompted, the user approves the action to run it or denies it to block it.
6. When the action runs, network, file type, sandbox, and connector scope rules limit what it can reach.

{#gov-pol-action-approval-flow__ol-evaluation-order}

## Tool gates {#gov-pol-action-approval-flow__tool-gates}

Each tool gate has one of the following modes:
{#gov-pol-action-approval-flow__table-tool-gate-modes__entry__2}

| Mode | Behavior |
|-|-|
| Allow | Runs the action without checking approval patterns or prompting. |
| Deny | Blocks the action, with no option to approve it. |
| Require approval | Checks the action against approval patterns, and prompts the user only when a pattern calls for it. |
| Auto approval | Sends the action to the model reviewer, except actions under a hard gate. This happens only when the auto approval capability is on and the user's chat is in auto mode. Otherwise, the gate works as if it requires approval. |
[Table 1. Tool gate modes]

{#gov-pol-action-approval-flow__table-tool-gate-modes}

A tool with no tool gate is handled as if its gate requires approval. Because auto approval is set on each tool gate, you can reduce prompts on one frequently used tool while keeping stricter handling on others.

## Approval patterns {#gov-pol-action-approval-flow__approval-patterns}

Approval patterns identify the commands that need a person's decision. They apply to tools whose gate requires approval or uses auto approval, and to tools with no gate. The default Arc policy includes predefined patterns, grouped by category.

Each pattern matches commands in one of the following ways:
{#gov-pol-action-approval-flow__table-match-modes__entry__3}

| Match mode | Pattern | Matches when |
|-|-|-|
| Exact | A literal string or regular expression | The command matches the pattern as written. |
| Relaxed | Several words | The words appear in the command in order, even with flags and values between them. |
| Keyword | A list of write verbs | The command contains one of the listed verbs. |
[Table 2. Approval pattern match modes]

{#gov-pol-action-approval-flow__table-match-modes}

Exact matching is precise but can miss variations of a command. Relaxed matching catches variations but can match a word that appears where you didn't intend. Keyword matching catches any command that writes data, as long as its
verb is on your list.  
Note:  
A command that matches no approval pattern runs without a prompt. If you rely on keyword matching, a command that writes data with a verb that isn't on your list runs without approval.

Each pattern also has a gate that sets what happens when a command matches:
{#gov-pol-action-approval-flow__table-pattern-gates__entry__2}

| Gate | Behavior |
|-|-|
| Hard gate | Asks the user every time. The user can't save the decision. |
| Soft gate | Asks the user, who can save the decision for later actions of the same type. |
| Allow carve-out | Runs the command without a prompt, as an exception to a broader pattern. |
[Table 3. Approval pattern gates]

{#gov-pol-action-approval-flow__table-pattern-gates}

The default Arc policy applies hard gates to destructive operations, deletions, and changes to external systems, and soft gates to selected routine, low-impact patterns.

When more than one pattern matches a command, the pattern that matches more of the command wins, even if it comes from a lower-priority policy. For details, see [Policy stacking and precedence in ServiceNow Arc](https://www.servicenow.com/docs/rnc0vtiFjBQEgtcAgl05Uw "When more than one policy applies to a user, Arc merges them into one effective policy and resolves any conflicts by priority, specificity, and restrictiveness.").

## Auto approval {#gov-pol-action-approval-flow__auto-approval}

Under auto approval, Arc still prompts the user for any action under a hard gate. An AI model reviewer evaluates every other action, including actions that match no pattern, against the user's request.

The model reviewer escalates actions that are destructive, irreversible, or visible outside Arc. Some of these actions escalate every time. Others escalate unless the user's request clearly identifies what to act on. For example, "close INCXXXXXXX" identifies a specific record, but "clean up the incidents"
doesn't. An approved action proceeds. An escalated action appears to the user as a standard approval card.

Auto approval works only when the auto approval capability is turned on for the user's policy and the user's chat is in auto mode. Otherwise, a tool gate set to auto approval works as if it requires approval. If the model reviewer
is unavailable, times out, or returns a decision that Arc can't read, Arc shows the approval card. See [Create a capability override for an Arc policy](https://www.servicenow.com/docs/sYJcq3IVKPYGjSoyAv6Umg "Turn a ServiceNow Arc feature on or off, or change a limit, for the users a policy covers without changing the default for anyone else.").  
Important:  
The model reviewer is an AI model, and its decisions may be inaccurate or inappropriate. Because the reviewer evaluates context, its decisions can vary. To keep a human review step for sensitive actions, put those actions under hard gates.

## What users see {#gov-pol-action-approval-flow__what-users-see}

When an action needs approval, Arc holds it and shows the user an approval card. The card offers Allow for every matched action, and Always Allow only for soft gate patterns. Steps that the model
reviewer approves show Auto-mode allowed this.

When a user selects Always Allow, Arc saves the decision and runs later actions of the same type without a prompt, such as the same command run on different files. An action of a different type prompts the user again. Users can view and revoke
saved approvals in SettingsApprovals. For more about the user's experience, see .

When an action reads or changes a path outside the user's workspace folders but inside the home folder, Arc asks for approval. The approval card offers Always Allow unless the policy would apply a hard gate to the same action on its own, in which case the user approves it each time. Because the
decision comes from the policy, a change to your approval patterns changes this behavior too.

Saved approvals and the model reviewer are the two ways an action can run without a prompt:
{#gov-pol-action-approval-flow__table-actions-without-prompt__entry__5}

| Method | Decision basis | Set by | Applies to | Best for |
|-|-|-|-|-|
| Saved approval | A user's saved decision for that type of action | The user, one approval at a time | Soft gate patterns only | Repeated actions of a known, stable type |
| Model review | An AI model's evaluation of the action in context | An administrator, by turning on the auto approval capability and setting a tool gate to auto approval, and the user, by switching the chat to auto mode | Actions not under a hard gate, including actions that match no pattern | Actions that a static pattern can't classify in advance |
[Table 4. Ways an action runs without a prompt]

{#gov-pol-action-approval-flow__table-actions-without-prompt}

Neither method approves a hard gate action or runs an action on a tool with a deny gate.

## Built-in protections {#gov-pol-action-approval-flow__built-in-protections}

Some checks are built into Arc and run before any approval pattern. No tool gate mode, approval pattern, or auto mode turns them off.

Sensitive files
:   Commands that touch credential and key files, such as SSH keys, cloud provider credentials, password manager data, or browser profiles, always need the user's approval.

Locations that run code automatically
:   Commands that write to locations where the operating system runs code automatically, such as scheduled tasks, always need the user's approval. On macOS, this also covers writes to folders in the user's Library folder that no
    sandbox rule allows.

Environment variable hijacking
:   Commands that set environment variables that change how programs load, such as `LD_PRELOAD`, always need the user's approval.

Arc configuration files
:   The agent can't read or change the files that hold Arc configuration and credentials. These commands are blocked, with no option to approve them.

For a tool whose gate requires approval, or a tool with no gate, Arc also asks for approval when a shell command writes to a file through a redirect, pipes its output into a program that isn't a safe pipe target, or uses shell syntax that can't be safely analyzed. Under an
allow gate or an auto approval gate, these checks are skipped.

*[\>]: and then