Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

Does ServiceNow Let AI Agents Change Records Without Approval?

Yes, when configured to: ServiceNow documents a Supervised mode in which an agent action requires user input or approval, and an autonomous mode in which agents running as a dedicated AI user change records with no human step. Check each workflow's mode, the identity it runs as, and what the activity log would show afterward.

A stack of business records sits beside an action path that leads through a large workflow ring.

Yes, when configured to: ServiceNow documents a Supervised mode in which an agent action requires user input or approval, and an autonomous mode in which agents running as a dedicated AI user change records with no human step. Check each workflow's mode, the identity it runs as, and what the activity log would show afterward. The question is often asked as if the platform had one policy. It has a set of configuration choices, documented separately, that together decide whether a person stands between an agent's decision and a change to a record. ServiceNow describes agentic workflows as self-executing, offers a Supervised mode that pauses for a user, lets an agent act either as the person who invoked it or as a dedicated AI user with its own roles, and provides activity logs that show what agents did. Each of those is a real control, and none of them is a default that answers the title question on its own. This page works through the modes, the identity choice and role masking, what the platform's security guidance does and does not say about approval, how untrusted content reaches an agent that can change records, what the activity log records and when, and what a buyer should verify. The underlying distinction is the one between a log and a gate, described in what an AI control record is: a record of what happened is not the same as a person who had to say yes.

Key findings

  • ServiceNow's Workflow Studio documentation states that in Supervised mode the AI agent action requires user input or approval to run the AI agent, which places the human step at the level of the action's configured mode (ServiceNow, 2026).
  • ServiceNow documents two identities for agents: the invoking user's identity, or an AI user, described as a dedicated, preconfigured user with assigned roles (ServiceNow, 2026).
  • Role masking caps an agent's reach: the agent cannot exceed the permissions defined by its masked role, even if the invoking user has broader access (ServiceNow, 2026).
  • ServiceNow's agentic AI security and governance page directs organizations to use agent activity logs to track what agents do, what data they access and when; human approval is not documented on that page (ServiceNow, 2026).
  • Researchers including ServiceNow's own found that firewall-style defenses against indirect prompt injection are not sufficient on their own and that stronger benchmarks are needed (Bhagwatkar et al., 2026).
  • A configuration in which an agent acts under its own identity with no human step is the condition the OWASP Top 10 for LLM Applications describes as excessive agency (OWASP, 2025).

What do Supervised and autonomous modes mean for a record change?

ServiceNow's AI Agent Studio overview describes agentic workflows as self-executing workflows, with AI Guardian adding safeguards against prompt injection and offensive content (ServiceNow, 2026). Self-executing is the operative word: the default shape of an agentic workflow is one that runs to completion once triggered. Against that default, the Workflow Studio documentation describes a Supervised mode in which the AI agent action requires user input or approval to run the AI agent (ServiceNow, 2026). The human step exists, and it is a mode a builder selects for an action.

Consider a single record type: a change request record in an IT service management console. An agentic workflow is built to triage incoming requests, enrich them with configuration data, set risk and priority, and, for low-risk standard changes, move the record to approved and schedule it. In Supervised mode, the action that runs the agent waits for a user before it proceeds, so the triage happens only after someone says go. In the alternative, the workflow runs when triggered, and the change request can move from new to scheduled without a person reading it. Both are legitimate configurations. Only one answers the title question with "no."

Two details follow from the documentation's wording. The Supervised mode pauses the action that runs the agent; whether every individual record write inside the agent's run is separately gated is not described in the pages reviewed. And the mode is per action, so a workflow can combine supervised and unsupervised actions. The answer for any given ServiceNow instance is therefore an inventory, action by action, of which mode each agentic workflow uses.

Which identity does the agent act as, and what does that change?

ServiceNow states that agents run either as the invoking user's identity or as an AI user, a dedicated, preconfigured user with assigned roles (ServiceNow, 2026). Under the invoking user's identity, the agent can change only what that person could, and the record carries that person's name. Under an AI user, the agent changes whatever the AI user's roles allow, and the record carries no person's name.

Role masking refines the first case: the agent cannot exceed the permissions defined by its masked role, even if the invoking user has broader access (ServiceNow, 2026). It is a control on scope, not on approval: a masked role that permits updating change requests still permits the agent to update them without consent if the action is not supervised.

Dimension ServiceNow, per its documentation What a buyer should verify
Execution mode Supervised mode requires user input or approval; workflows are self-executing The mode of every action in every agentic workflow
Acting identity Invoking user's identity, or a dedicated AI user with assigned roles Which workflows run as an AI user and what roles it holds
Scope cap Agent cannot exceed its masked role even if the invoking user has broader access The masked role assigned to each agent
Named approver Not documented on the security page reviewed Whether any approval names a reviewer other than the triggering user
Evidence Activity logs track what agents do, what data they access and when Whether the log separates approved changes from autonomous ones

The combination to watch for is the AI user identity with unsupervised actions: an agent that can change records with no human step, under an identity that belongs to no one, visible afterward in a log.

What does the security guidance say about approval?

ServiceNow's agentic AI security and governance page is the natural place to look for a platform position on approval, and it is worth being precise about what it contains. The page directs organizations to use agent activity logs to track what agents do, what data they access and when (ServiceNow, 2026). Human approval is not documented on that page. The approval mechanism that does exist, Supervised mode, is documented in the Workflow Studio pages rather than in the security guidance.

That placement is informative. It suggests that ServiceNow treats approval as a workflow design choice rather than a security control, and treats logging as the security control. There is nothing improper in that; many platforms draw the line the same way. But a buyer who reads the security page looking for assurance that agents cannot change records without a person will not find the sentence, and should not infer it. What the page offers is visibility after the fact, which is a different promise. The general case for pairing a log with a gate, so that consequential changes are both approved in advance and recorded with the approver's name, is made in how to set up an AI control record for AI agents.

AI Guardian, described on the AI Agent Studio overview as adding prompt injection and offensiveness safeguards (ServiceNow, 2026), is a control on inputs, not a human step. It aims to stop certain content from steering the agent. Whether it does so reliably is a question the next section takes up; what it is not is an approval.

How does untrusted content reach an agent that can change records?

A change request record is full of text written by other people: the description a requester typed, the comments added by a vendor, the attachment someone uploaded. An agent that triages the record reads all of it, and text that reads like an instruction can steer the agent's next step. The OWASP Top 10 for LLM Applications describes this as prompt injection, and the indirect form, where the instruction is in the data rather than the prompt, is the one that applies to an agent reading records (OWASP, 2025). For an unsupervised agent acting as an AI user, a successful injection becomes a record change with no person in the way.

The evidence that input filtering alone does not close this is unusually direct in ServiceNow's case, because researchers from ServiceNow, Mila and partner universities published it. Their preprint asks whether firewalls are all you need against indirect prompt injection, and concludes that current defenses are insufficient and that stronger benchmarks are needed to evaluate them (Bhagwatkar et al., 2026). Read alongside the AI Guardian description, the implication is not that AI Guardian is useless, but that a vendor's own researchers caution against treating input screening as a complete defense.

Government guidance reaches the same practical conclusion. CISA and partner agencies, in joint guidance on the careful adoption of agentic AI services, counsel organizations to understand what actions agents can take, under what identity, and with what oversight before deploying them (CISA, 2026). The structural fix OWASP's excessive agency entry describes is to limit permissions and autonomy to what the task requires and keep a human in the path for consequential actions. On ServiceNow, that maps to a masked role and Supervised mode together, not either alone.

What does the activity log show, and when?

The activity log is the control ServiceNow's security page foregrounds, and it is a strong one as logs go. It tracks what agents do, what data they access and when. For the change request example, an administrator can establish that an agent read the record, which configuration items it consulted, that it set the state to scheduled, and at what time. If the agent ran as an AI user, the log shows that identity; if it ran as the invoking user, it shows the person.

Three questions decide how much the log is worth for governance. First, does it distinguish a change that passed through Supervised mode from one that did not, so that a reviewer can tell approved changes from autonomous ones without cross-referencing workflow configuration? That is not described in the pages reviewed. Second, does it record who gave the approval when Supervised mode was used, as an event with a name? Also not described in the pages reviewed. Third, does it record what the agent read, in content, or only which records it accessed? The documentation says what data agents access, which may mean either.

The NIST AI Risk Management Framework's Govern and Manage functions expect organizations to assign accountability for an AI system's actions and to be able to respond to incidents with evidence (NIST, 2023). A log that shows an AI user changed a record satisfies the second expectation and leaves the first open, because an AI user is not an accountable person. The design that closes both is a record in which every action carries either the invoking person's identity or the named approver's, so that each record change is traceable to a human decision. Whether ServiceNow's activity log can be configured to carry that is a matter for the current documentation.

What does a governed environment change?

A governed environment places a named person in front of every record change regardless of the mode configured on each AI agent action, so the human step no longer depends on a builder choosing Supervised over autonomous. ServiceNow documents that in Supervised mode the action requires user input or approval, while an autonomous workflow running as a dedicated AI user changes records with no human step (ServiceNow, 2026). Approval becomes a property of the deployment, not of each action.

This class of control acts on the rendered screen and on the action. Sensitive values on an incident, case or HR record are replaced with consistent tokens before any model reads them, so the task runs on tokens. Real values resolve only at an approved destination at the moment of an approved action, such as the record update written to the platform. A named person confirms what is tokenized and approves consequential actions, including record changes, before they execute. Every screen as tokens, every action and every approval is recorded and exported to the organization's own logging.

The page's evidence shows why the gate and the record both matter. ServiceNow's governance guidance relies on activity logs, and a log records a change already made. Researchers including ServiceNow's own found that firewall-style defenses against indirect prompt injection are not sufficient alone (Bhagwatkar et al., 2026), so an instruction in a ticket description can reach an agent that can write. The gate stops the write before it lands, and the exported record names the person who approved it, which the activity log may not.

The environment does not alter the workflow's mode, the AI user's roles, role masking or the model.

Where does RedactSure sit?

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company. The design addresses the two rows the platform's configuration leaves open: a named approver for every record change, and a record that joins what the agent read to who approved what it did. Work runs in a governed environment in the customer's cloud. When an agent opens a change request, an incident or a console page, substitution happens at the render layer before any model reads the screen, so identifiers appear to the model as consistent tokens such as ACCT_001 or PATIENT_001 for the whole run. Real values resolve only at approved destinations at the moment of an approved action. A named person confirms the tokenization policy and approves every payment, submission and record change under Supervised Delegation, so no change is made under an identity that belongs to no one. Every screen as tokens, every action and every approval lands in the AI Control Record and exports to the customer's SIEM. The design is model agnostic, requires no per-application integration, and leaves user permissions unchanged, so ServiceNow roles and masking remain in force beneath it.

Deployments are in pilot. For this page's question, a pilot on the reader's own ServiceNow workflow would show, for one agentic workflow and one record type, which changes reached a named approver, what the approver saw before deciding, and the record each produced, set beside the platform's own mode settings and activity log. Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

This page rests on ServiceNow's own documentation: the Workflow Studio page on using an AI agent action, the access control implementation page for AI agents, the page on ACLs, role masking and user identities in AI Agent Studio, the agentic AI security and governance page, and the AI Agent Studio overview (all vendor documentation). It also draws on a preprint on indirect prompt injection defenses co-authored by ServiceNow researchers, the OWASP Top 10 for LLM Applications entries on excessive agency and prompt injection (industry standards), the joint CISA guidance on careful adoption of agentic AI services (official guidance), and the NIST AI Risk Management Framework (official guidance). All sources were read as of October 16, 2026.

No hands-on testing of ServiceNow, AI Agent Studio or AI Guardian was performed. "Not described in the pages reviewed" and "not documented on that page" concern the documentation consulted, not claims that the product lacks a capability; approval features may be documented on pages not reviewed. Vendor features change, and ServiceNow updates these pages often; the page carries its date for that reason. Statements about RedactSure describe its current design, with deployments in pilot. The change request record and IT service management console examples describe record types and configurations, not any organization; no customer or prospect is described.

Whether a given instance's workflow modes, agent identities, role masking and logging satisfy an organization's obligations is a determination for its counsel, its assessors and its own security and compliance officers, not for a research page.

What the record shows

ServiceNow documents the pieces of a careful configuration without assembling them into a default. Agentic workflows are self-executing; a Supervised mode exists in which an action requires user input or approval; agents run as the invoking user or as a dedicated AI user; role masking caps what an agent can reach; and activity logs show what agents did afterward. Put together, an agent configured as an AI user with unsupervised actions can change records with no human step, visible only in the log, and nothing on the platform's security guidance page describes approval. The platform allows the opposite configuration too. The test is to name one agentic workflow and one record type it changes, and ask which mode each writing action is in, which identity it runs as, and whether the activity log would show a person's name against the change or an AI user's.

Frequently asked questions

Does ServiceNow require approval before an AI agent changes a record?

Not as a platform default. ServiceNow documents a Supervised mode in which the AI agent action requires user input or approval to run the agent, and describes agentic workflows as self-executing. Whether a given change needs approval depends on the mode a builder selected for that action. An instance can hold supervised and unsupervised workflows side by side, so the answer is an inventory of actions and modes, not a single setting.

What is the difference between running as the invoking user and as an AI user?

Under the invoking user's identity, the agent can change only what that person could, and the record shows the person's name. Under an AI user, described by ServiceNow as a dedicated, preconfigured user with assigned roles, the agent changes whatever those roles permit and the record shows the AI user. The second configuration is where an agent can act with no human step and no accountable person named against the change.

Does role masking stop an agent from changing records?

It limits which records and fields an agent can reach: ServiceNow states the agent cannot exceed the permissions of its masked role even when the invoking user has broader access. That is a scope control. If the masked role includes write access to change requests, the agent can still update them without approval unless the action is in Supervised mode. Masking and supervision address different questions and are needed together.

Does AI Guardian make unsupervised agents safe?

ServiceNow describes AI Guardian as adding prompt injection and offensiveness safeguards. It screens inputs; it is not an approval step. A preprint co-authored by ServiceNow researchers asks whether firewalls against indirect prompt injection are sufficient and concludes that current defenses are not, on their own. A screening control reduces the chance that injected text steers an agent. It does not place a person between the agent and a record change.

What does the agent activity log record?

ServiceNow's security guidance directs organizations to use agent activity logs to track what agents do, what data they access and when. For a record change, that shows which agent or identity made it and at what time. Whether the log distinguishes supervised from autonomous changes, names the approver for supervised ones, or records the content the agent read rather than the records it accessed, is not described in the pages reviewed and should be confirmed.

What configuration should a cautious organization start with?

Supervised mode on every action that writes records, the invoking user's identity where a person triggers the workflow, a masked role that excludes write access to anything the agent only reads, and an AI user only where no person is in the loop and the roles are limited to the workflow's tasks. Then review the activity log for a sample of runs to confirm that every record change carries a person's name, either as the invoker or as the approver who said yes.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.