---
sourceDocument: Brazil Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/intelligent-experiences

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Policy management and governance in ServiceNow Arc

# Policy management and governance in ServiceNow Arc {#ariaid-title1}

Release version: Brazil  
Updated September 7, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Policies are governance rules on your
ServiceNow instance that control what ServiceNow Arc can do, which actions need approval, and which actions are
blocked.

ServiceNow Arc is an autonomous AI agent that runs commands, reads and writes files, and reaches external systems on behalf of users. Because the agent acts for users, your organization needs control over what the
agent can do.

Policies give you that control. You author policies on the ServiceNow instance, and every ServiceNow Arc client enforces them on every action before the action runs. Users work within the boundaries set and approve actions when a policy requires it. Policies are the centrally managed rules and governance
components that control what the agent can and can't do, preventing it from taking actions outside the boundaries you define. Every action the agent attempts is evaluated against the active policy before it runs.  
The following properties make policy a governance mechanism rather than guidance:

Central authoring

:   Policies live in ServiceNow tables on your instance, not in local configuration that a user can
    edit.

Enforcement in code

:   ServiceNow Arc enforces policy on every action, and neither the agent nor end users can bypass policy
    rules. Enforcement happens in code, not through the agent's instructions,
    so it doesn't depend on the agent choosing to conform.

Mandatory policy

:   ServiceNow Arc runs nothing without a policy. Until the client retrieves an active policy from your instance, Arc doesn't perform any action.

## How policy reaches the client {#policy-management-cowork__policy-sync}

The instance merges every policy that applies to a user and sends the client one effective policy bundle. Clients never see the individual policy records.

When you change a policy, the instance pushes the change to clients in near real time. Clients also check for changes in case they miss a push. Users can see the last policy sync time in their ServiceNow Arc application under SettingsAgent Sandbox.

A policy bundle doesn't expire. If the instance becomes unreachable, the client keeps enforcing the last policy it retrieved.

## Default Policy {#policy-management-cowork__default-policy}

Every instance includes the Default Policy. It's active, applies to all users, and includes values for all seven policy components. You can't edit the Default Policy. To change its
behavior, create a policy with a lower priority number. For more information, see [Policy stacking and precedence in ServiceNow Arc](https://www.servicenow.com/docs/vLAl47DCP6XmQv6mhO2Pgg "When more than one policy applies to a user, ServiceNow Arc merges them and resolves conflicts by priority in a fixed order, specificity, and restrictiveness.").

For what each component controls, see [Policy components in ServiceNow Arc](https://www.servicenow.com/docs/QPQ3S3cNXdW3qv2Iq91JoQ "A ServiceNow Arc policy has seven components, each controlling a different part of what the agent can do.").
* **[Policy components in ServiceNow Arc](https://www.servicenow.com/docs/QPQ3S3cNXdW3qv2Iq91JoQ)**   
  A ServiceNow Arc policy has seven components, each controlling a different part of what the agent can do.
* **[Action approval flow in ServiceNow Arc](https://www.servicenow.com/docs/qQeBSRXY3PZvYPcxu5Yd9Q)**   
  Tool gates, approval patterns, and auto approval determine whether each action in Arc runs, requires approval, or is blocked.
* **[Policy stacking and precedence in ServiceNow Arc](https://www.servicenow.com/docs/vLAl47DCP6XmQv6mhO2Pgg)**   
  When more than one policy applies to a user, ServiceNow Arc merges them and resolves conflicts by priority in a fixed order, specificity, and restrictiveness.
* **[How policy affects ServiceNow Arc users](https://www.servicenow.com/docs/I6ixoVojSlehIOAqQ7JJ_Q)**   
  Your administrator's policies decide what ServiceNow Arc can do for you. You see the result as approval prompts and blocked actions, and you can narrow some permissions yourself.

*[\>]: and then