---
sourceDocument: Australia Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/intelligent-experiences

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Explore

# Exploring policies in AI Control Tower {#ariaid-title1}

Release version: Australia  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Exploring policies in AI Control Tower

Policies within AI Control Tower enable ServiceNow customers to automate governance and enforcement actions across AI systems in their organization.
Instead of manually scripting responses to AI threats or blocking AI usage reactively, policies provide reusable rules that automatically manage risks such as prompt injections or data exposure.
These policies help control AI agent behavior, usage permissions, and Arc's capabilities on user devices, ensuring consistent enforcement across multiple platforms and environments.
Show full answer Show less  

## Key Features

* **Policy Types:**
  * **Threat Response:** Monitors specific threat categories and triggers automatic actions like deactivating affected AI agents or creating incident tickets when thresholds are crossed.
  * **Explicit Block:** Blocks users, departments, or all users from accessing specified AI agents, models, or domains until the policy is removed.
  * **Arc Policies:** Define what ServiceNow Arc can do on users' devices, including permitted tools, network destinations, and whether actions require user approval.
* **Policy Enforcement Points:** Policies are enforced across multiple integration points including Agent Client Collector (ACC), cloud-hosted AI platforms (e.g., Amazon Bedrock, Azure AI Foundry), Okta-managed identities, and ServiceNow-hosted AI agents to ensure comprehensive governance.
* **Policy Management Workflow:** AI stewards configure enforcement points, create and publish policies, and monitor enforcement activity to verify effectiveness.
* **Policy Preview and Audit:** Customers can preview which AI requests a policy would affect before publishing and review detailed enforcement logs explaining which policy blocked or allowed specific requests.
* **Role-Based Access:** AI stewards manage Threat Response and Explicit Block policies; AI stewards with Arc admin roles additionally manage Arc policies.

## Key Outcomes

* Automated prevention and containment of AI-related threats reduce manual effort and response time.
* Consistent enforcement of AI usage policies across diverse platforms and user groups enhances security and compliance.
* Granular control over AI agent behavior and Arc capabilities allows tailored governance aligned with organizational policies.
* Visibility into enforcement activities enables continuous policy validation and improvement.  
Learn how policies let you automatically respond to detected AI threats, block AI usage outright, or control what Arc can do on your users' devices, and where policies are enforced across AI Control Tower.

## Policies overview {#gov-pol-exploring__cf-exploring-parent-overview}

Blocking a rogue AI agent or containing a detected threat typically involves writing custom scripts, or reacting to an issue that's often discovered well after it has occurred. These approaches don't scale past a handful of one-off
exceptions, and they don't hold up consistently across every platform your organization runs AI on.

Policies address this by letting you define that governance once, as a reusable rule, instead of reacting case by case.

* Respond automatically when a detected threat, such as a prompt injection or excessive data exposure, crosses a threshold you define.
* Stop a specific AI agent, model, or domain from being used, without writing a flow.
* Control which tools, network destinations, and files Arc can use, and which of its actions wait for a person's approval.
* Preview which requests a policy would affect before publishing it.
* See exactly which policy blocked or allowed a given request, and why.

## Policy users {#gov-pol-exploring__cf-exploring-parent-users}

{#gov-pol-exploring__table_pol_users__entry__2}

| User | Description |
|-|-|
| AI steward | Creates, edits, clones, and deletes Threat Response and Explicit Block policies, and reviews policy enforcement activity to confirm policies are working as expected. |
| AI steward with the Arc admin role | Creates, edits, and deletes Arc policies and the rules in them. |
[Table 1. Users]

{#gov-pol-exploring__table_pol_users}

## Policy types {#gov-pol-exploring__pol-policy-types-summary}

Each policy type suits a different governance need.

Threat Response
:   Watches for a specific threat category, such as sensitive data disclosure or prompt injection, crossing a threshold you define (for example, more than 50 detections in 10 minutes). When triggered, deactivates the affected agent,
    and can create a ticket for a team or notify a group. The affected agent stays offline until it's reinstated. For details, see [Threat Response policies](https://www.servicenow.com/docs/NYH5bipB9WQBKDso32c~CA "Automatically contain an AI agent the moment it crosses a risk threshold you define, instead of waiting for someone to notice and act.").

Explicit Block
:   Stops a user, a department, or everyone from using a specific AI agent, model, or domain. Once initiated, the block stays in effect until the policy is deleted. For details, see [Explicit Block policies](https://www.servicenow.com/docs/nSGgLgTqL4TK6prCUkr3uw "Stop a specific person, a department, or your whole organization from using an AI agent, model, or domain, enforced automatically everywhere that access could happen.").

Arc
:   Shapes what ServiceNow Arc can do on users' devices, such as which tools it can call, which hosts it can reach, and which actions wait for approval. Each policy layers over the default Arc policy for the users it covers. For details, see [Arc policies](https://www.servicenow.com/docs/V4niCO1s0VqvTDuwsBmbug "Control which tools, commands, network destinations, files, and connector permissions ServiceNow Arc can use on your users' devices, and which actions wait for a person's approval, from AI Control Tower.").

## Policy enforcement points {#gov-pol-exploring__enforcement-points}

Policies are evaluated and enforced at points throughout your organization.

Agent Client Collector (ACC)
:   Blocks and unblocks AI agents by model or domain, through ACC's AI governance policy.

Cloud-hosted agent platforms
:   Amazon Bedrock, Amazon Bedrock AgentCore, Azure AI Foundry, and Gemini Enterprise Agent Platform agents. Each platform is enforced through its own native access control, so the same rule reaches an agent no matter which of these it
    runs on.

Okta
:   Blocks and unblocks a person's access through their Okta-managed identity.

ServiceNow agents
:   Blocks and unblocks AI agents hosted by ServiceNow.

For a complete list, see [Control enforcement points](https://www.servicenow.com/docs/ZkzgO~cuPRCORfXcNKYPwA "The systems that AI Control Tower policies can act on.").

## Policies workflow {#gov-pol-exploring__cf-exploring-parent-workflow}

This infographic shows a sample end-to-end workflow of the AI steward sets up policy enforcement points, creates policies, and reviews enforcement activity.
Figure 1. Managing policies in AI Control Tower  
In this workflow:

1. The AI steward configures one or more control enforcement points.
2. The AI steward creates a Threat Response policy and defines the threat category, its scope, and the threshold that triggers a response.
3. The AI steward creates an Explicit Block policy and defines who is blocked and what they're blocked from using.
4. Once published, the policy is enforced at whichever connected points apply.
5. The AI steward reviews enforcement activity to confirm the policy is working as expected.
{#gov-pol-exploring__cf-exploring-parent-workflow-ol}

## Policies benefits {#gov-pol-exploring__cf-exploring-parent-benefits}

{#gov-pol-exploring__table_pol_benefits__entry__3}

| Benefit | Feature | Users |
|-|-|-|
| Respond automatically to a detected threat before it spreads further. | [Create a Threat Response policy](https://www.servicenow.com/docs/ky7RNwurCD6I51CR~2owkA "Automatically contain an AI agent when a specific threat is detected.") | AI steward |
| Stop specific AI usage outright, without writing a flow. | [Create an Explicit Block policy](https://www.servicenow.com/docs/YmXLmKWc8VkrC3niejKYEA "Stop a user, a department, or everyone in your organization from using a specific AI agent, model, or domain.") | AI steward |
| Give specific groups different Arc behavior, without changing the default for everyone. | [Managing ServiceNow Arc policies in AI Control Tower](https://www.servicenow.com/docs/myD5tuuw9s1m6V20rjtbIQ "Create and manage ServiceNow Arc policies that control what Arc can do, which actions need approval, and which actions are blocked.") | AI steward with the Arc admin role |
| Confirm a policy is working as expected. | [Reviewing policy enforcement activities in AI Control Tower](https://www.servicenow.com/docs/O1Ized_5LL_1wFy3YjJvjQ "Review policy activities and execution results.") | AI steward |
[Table 2. Policies benefits]

{#gov-pol-exploring__table_pol_benefits}

## What to explore next {#gov-pol-exploring__cf-exploring-parent-links}

To learn more about configuring and using Policies, see:

* [Configuring policies in AI Control Tower](https://www.servicenow.com/docs/HRot7l~_j9VQ8SST_Eh0Jg "Set up policies in AI Control Tower by configuring control enforcement points.")
* [Managing policies in AI Control Tower](https://www.servicenow.com/docs/924ksIL1dlJiNkmAhWaDTw "Create, change, or remove the policies that respond to detected threats or block AI usage.")
* [Managing ServiceNow Arc policies in AI Control Tower](https://www.servicenow.com/docs/myD5tuuw9s1m6V20rjtbIQ "Create and manage ServiceNow Arc policies that control what Arc can do, which actions need approval, and which actions are blocked.")
* [Reviewing policy enforcement activities in AI Control Tower](https://www.servicenow.com/docs/O1Ized_5LL_1wFy3YjJvjQ "Review policy activities and execution results.")
* [AI Control Tower policies reference](https://www.servicenow.com/docs/K_fDQ9b_tvLzJyN240KkLQ "Reference topics provide additional information about threat types and where policies are enforced.")
{#gov-pol-exploring__ul_pol_explore_next}