---
sourceDocument: Brazil Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/intelligent-experiences

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Create a Threat Response policy

# Create a Threat Response policy {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Automatically contain an AI agent when a specific threat is detected.

## Before you begin

Confirm the connector for each AI agent runtime platform you want to cover is active. See [Configuring security connections](https://www.servicenow.com/docs/07H58FaIPRdJHGp8iWlPbA "Connect AI Control Tower to the platforms where your AI agents run and to your identity provider so that policies and AI agent containment using kill switch protocol can act on agents wherever they're hosted.").

Role required: sn_ai_governance.ai_steward

## About this task

A Threat Response policy watches for a specific threat type. Once conditions matching that type are detected, it automatically contains the affected agent instead of waiting for someone to notice and act.

## Procedure

1. Navigate to AllAI Control TowerHomeGovernPolicies.
2. Select Create policy.
3. Enter a name and description of this policy.
4. In the Policy type section, select A threat response.
5. In the On threat section, select the threat type the policy watches for, such as Prompt Injection.  
   For the full list, see [Threat types](https://www.servicenow.com/docs/leHj5twrVf025F8A7P7Z~w "Threat types available in a Threat Response policy.").
6. In the On threat section, define which agents the policy covers.  
   Build a condition from a field, an operator, and a value, such as a specific agent or a platform vendor. Combine multiple conditions with and or or, or select Add group for another set of conditions.
7. In the On threat section, set the sensitivity.  
   For example, trigger the policy on every detection, or only once detections cross a threshold you define.
8. **Optional:** In the Do this section, add one or more follow-up actions.  
   A follow-up fires only when the policy actually blocks an attempt, not just because it's published.

   | Follow-up action | Description |
   | Create a ticket | 1. Select +Add follow-up. 2. Select Create a ticket. 3. Select the assignment group that will receive the ticket. {#gov-pol-create-threat-response-policy__ol_b2q_fxr_jkc} |
   | Notify | 1. Select +Add follow-up. 2. Select Notify. 3. Search or enter the user to notify. {#gov-pol-create-threat-response-policy__ol_knl_hxr_jkc} |
   |-|-|

   {#gov-pol-create-threat-response-policy__choicetable_tqh_bxr_jkc}
9. Review the policy summary, then select Publish.

## Result

The policy runs as soon as a matching threat is detected. The affected agent is taken offline and stays offline until it's reinstated from Security. For details, see [Contain AI agents manually using kill switch protocol](https://www.servicenow.com/docs/9QJJbaq_CIoqKdvvvTvYTw "Deactivate or reinstate AI agents using kill switch protocol to help improve your security posture and stop malicous activity.").

## What to do next

Confirm the policy is working as expected by reviewing policy enforcement activity. For details, see [Reviewing policy enforcement activities in AI Control Tower](https://www.servicenow.com/docs/USwzNQvSNreevbfxQFT1CQ "Review policy activities and execution results.").

You can edit a Threat Response policy directly to change its threat type, scope, sensitivity, or follow-up actions. For details, see [Edit a Threat Response policy](https://www.servicenow.com/docs/oxGlRXxVsIjFQdaltF1szQ "Change an existing Threat Response policy's threat type, scope, sensitivity, or follow-up actions."). Alternatively, clone the policy to test a variant without changing the original, then delete the original once your clone is confirmed working, if you no longer need it. For details, see [Clone a policy](https://www.servicenow.com/docs/k8X5swLRBx7HSd0vw6aHhw "Start a new policy using an existing policy as a template.").

*[\>]: and then