---
sourceDocument: Brazil Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/intelligent-experiences

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Configuring security connections

# Configuring security connections {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Connect AI Control Tower to the platforms where your AI agents run and to your identity provider so that policies and AI agent containment using kill switch protocol can act on agents wherever they're hosted.

## Key benefits {#aict-configuring-security-connections__section_security_key_benefits}

* Connect AI Control Tower to these platforms that host your AI agents: Agent Client Collector (ACC), AWS Bedrock, AWS Bedrock Agent Core, Gemini Enterprise Agent Platform, Azure AI Foundry, and ServiceNow Agents. Also, you can use Okta as an identity provider, so policy and containment actions can reach agents no matter where they run.
* Deactivate an AI agent through Deny Resource policies applied directly on the AI agent runtime platform, without requiring a separate identity provider connection.
* Add an Okta connection to strengthen containment: when an agent's identity is federated through Okta, deactivating the agent also prevents future tokens from being issued to it.
{#aict-configuring-security-connections__ul_security_key_benefits}

## Security connections and AI agent containment {#aict-configuring-security-connections__section_security_connections_and_containment}

A security connection authenticates AI Control Tower to the platform or identity provider where an AI agent runs, so that policies and AI agent containment using kill switch protocol can act on that agent. Each connector uses a different
authentication model --- access key credentials for AWS Bedrock and AWS Bedrock Agent Core, OAuth 2.0 with a JWT Bearer grant for Gemini Enterprise Agent Platform, an Azure AD app registration for Azure AI Foundry, and an API key for
Okta --- but every connector ultimately creates a security connector record that appears under the Established connections tab.

Behind the scenes, AI agent containment is enforced differently depending on which connections you have in place:

* On a supported AI agent runtime platform (AWS, Gemini Enterprise Agent Platform, and ServiceNow), deactivating an AI agent using kill switch protocol applies a Deny Resource policy directly on that platform. This prevents the agent from acting on that platform.
* On Azure AI Foundry, deactivating an AI agent using kill switch protocol disables the agent application directly through the Azure Resource Manager API, rather than applying a Deny Resource policy.
* If you also add an Okta connection, and the AI agent's identity is federated through Okta (AWS Bedrock, AWS Bedrock Agent Core, Gemini Enterprise Agent Platform, and ServiceNow Agents), deactivating the agent additionally prevents future tokens from being assigned to it.

Important:  
AI agent containment for Gemini Enterprise Agent Platform agents is supported only for agents that have a unique agent identity configured. See [Add a Gemini Enterprise Agent Platform connection](https://www.servicenow.com/docs/J3gPukzLg2roDKGOM04X6w "Connect Gemini Enterprise Agent Platform to AI Control Tower using a service account and OAuth 2.0 JWT Bearer authentication, so policies and AI agent containment using kill switch protocol can reach and act on agents running on Gemini Enterprise Agent Platform.").
* **[Add an AWS Bedrock or AWS Bedrock Agent Core connection](https://www.servicenow.com/docs/Ij3pGbATG~qiP6SqBMqjVg)**   
  Connect AWS Bedrock or AWS Bedrock Agent Core to AI Control Tower so policies and AI agent containment using kill switch protocol can reach and act on agents running on AWS.
* **[Add an Azure AI Foundry connection](https://www.servicenow.com/docs/Lf8lBjfa8zpuzI495MK8JQ)**   
  Connect Azure AI Foundry to AI Control Tower so that policies and AI agent containment using kill switch protocol can reach and act on agents running on Azure AI Foundry.
* **[Add a Gemini Enterprise Agent Platform connection](https://www.servicenow.com/docs/J3gPukzLg2roDKGOM04X6w)**   
  Connect Gemini Enterprise Agent Platform to AI Control Tower using a service account and OAuth 2.0 JWT Bearer authentication, so policies and AI agent containment using kill switch protocol can reach and act on agents running on Gemini Enterprise Agent Platform.
* **[Add an Okta connection](https://www.servicenow.com/docs/z7v62aa3qy2x70CvyxE8lA)**   
  Connect Okta to AI Control Tower so that policies and AI agent containment with kill switch protocol prevent future tokens from being issued to a deactivated AI agent.
* **[Add an Agent Client Collector (ACC) connection](https://www.servicenow.com/docs/FHa5r9nhnhG202fDfO6b7g)**   
  Block and unblock AI usage on managed devices by configuring Agent Client Collector (ACC) as a control enforcement point.