--- sourceDocument: Brazil Enable AI sourceDocumentLink: https://www.servicenow.com/docs/r/intelligent-experiences Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Enable AI ft:clusterId : - platai bundleId : - platai workflow : - Platform --- # Governing AI asset security # Governing AI asset security {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Get a snapshot of your AI asset's security posture and visualize how your asset relates to other agentic assets in your enterprise in the AI agent map. When you open an AI asset record, the Security tab shows the AI asset security score, access issues, security events, and its access posture, based on whether the asset was given elevated privileges or has been dormant (inactive) for over 90 days. It also shows the AI agent map which illustrates how the AI asset relates to other managed AI agents, agentic workflows, providers, and tools across your enterprise. For AI models, the Security tab shows the AI asset security score, security events, and the AI agent map only. Get details for each metric area by selecting the arrow in the upper-right corner of each metric. If there's no data available for the asset, metrics don't show on the page. ## AI asset security score {#gov-sec-ai-asset__score} The AI asset security score is a measure of the health of your AI asset in terms of access issues, privileged AI agents, dormant AI systems, output deviation, PII detection, and other criteria. Users should actively manage and review their agent assets and not rely solely on this AI asset security score. For more information, see [Configure the AI asset security score](https://www.servicenow.com/docs/9Rvs~tI_4BBTLETuu88YxA "Customize the AI asset security score to align with your enterprise's security practices. You can omit large language model (LLM) guardrail categories from the score or change the weights of categories."). ## Access issues {#gov-sec-ai-asset__accessissues} The number of access issues encountered by this AI asset for the last 24 hours, by default. For example, the AI agent couldn't access a database field. AI agents with access issues may be unable to complete their workflows due to the access issue. Access issues can also be due to misconfiguration or potentially malicious acts by an agent. ## Security events {#gov-sec-ai-asset__events} The number of security events associated with the AI asset for the last 24 hours, by default. An AI asset security event is an occurrence that involves a potential threat to your environment's security. For example, if a credit card number is detected in LLM output (output PII violation), or if a user replaces an LLM prompt with a malicious prompt designed to obtain a user's password (prompt injection). Each AI asset security event has a threat type assigned. For more information, see [Managing AI asset security reference](https://www.servicenow.com/docs/SD7VolQZ9Kry0LOzotYbFA "Reference topics provide additional details about the charts and metrics that you use to assess your AI asset security posture in AI Control Tower."). ## Access posture {#gov-sec-ai-asset__status} Whether the asset was given elevated privileges or has been dormant for the time period shown, expressed in Coordinated Universal Time (UTC). Privileged : The AI agent has elevated permissions, such as an agent with admin or security admin permissions that can perform critical actions. Some workflows require that AI agents have elevated permissions to complete. An external AI agent is privileged if it has write, modify, or delete access to systems or data. For example, access to cloud infrastructure, IAM configurations, secrets managers, key management services, production databases, or security configurations. Dormant : The AI agent has been inactive for 90 days or longer. Review dormant AI agent permissions to reduce security risk. ## AI agent containment {#gov-sec-ai-asset__containment} If a security event of any severity is detected for an AI agent in the Agentic AI category, a banner appears on both the asset's Overview tab and its Security tab, letting you take action directly from the asset record. Select View containment options on the banner to open a side panel showing recent critical events for the asset and a Deactivate action. Deactivating the asset triggers AI agent containment using kill switch protocol; you can track progress from the banner and retry the operation if it fails or partially completes. After the underlying issue is resolved, you can reinstate the asset. For details, see [Contain AI agents manually using kill switch protocol](https://www.servicenow.com/docs/9QJJbaq_CIoqKdvvvTvYTw "Deactivate or reinstate AI agents using kill switch protocol to help improve your security posture and stop malicous activity."). An AI agent can also be contained automatically when a Threat Response policy detects a matching threat. For details, see [Threat Response policies](https://www.servicenow.com/docs/svS5dgK74QK1KPr1eVaQmg "Automatically contain an AI agent the moment it crosses a risk threshold you define, instead of waiting for someone to notice and act."). ## AI agent map {#gov-sec-ai-asset__map} The agent map is an interactive node map showing the relationships of your AI agents, agentic workflows, and tools across your enterprise. You can use the map to review these relationships and AI asset details. When you expand the map, you can filter by agents and agentic workflows. For more information, see [Discover your agent network with the map](https://www.servicenow.com/docs/CV8y3VVCjI7z1ADwhS8QWA "Use the agent map to visualize your entire agentic ecosystem, including ServiceNow and third-party AI assets.").