Configure a ServiceNow Arc agent policy
Add tool gates, approval patterns, network rules, sandbox rules, capability overrides, connector scopes, and file type rules to a policy to control what Arc can do for the users the policy applies to.
Before you begin
Create the policy. For more information, see Create a ServiceNow Arc agent policy.
Role required: sn_app_arc.admin
About this task
Each tab on a policy record links existing rule records to the policy. Add only the components you need. The number on each tab shows how many records are linked to the policy.
You can't edit or delete the Default Policy, or add rules to it. To change its behavior, create a policy with a lower priority number.
When you use a policy to override the Default Policy, add only the rules you want to change. Anything you don't add keeps coming from the Default Policy.
You can also manage policies and their rules in AI Control Tower. For more information, see Manage Arc agent policies in AI Control Tower.
Procedure
-
Navigate to All > ServiceNow Arc > Policies > Arc Agent Policy.
-
Open the policy you want to configure.
-
Add a tool gate.
-
Select the Policy Tool Gates tab, and then select New.
-
In the Tool Gate field, select the tool gate.
-
In the Domain field, select the domain.
-
Select Submit.
-
-
Add an approval pattern.
-
Select the Policy Patterns tab, and then select New.
-
In the Approval Pattern field, select the approval pattern.
-
In the Domain field, select the domain.
-
Select Submit.
-
-
Add a network rule.
-
Select the Policy Network Rules tab, and then select New.
-
In the Network Rule field, select the network rule.
-
In the Domain field, select the domain.
-
Select Submit.
-
-
Add a sandbox rule.
-
Select the Policy Sandbox Rules tab, and then select New.
-
In the Sandbox Rule field, select the sandbox rule.
-
In the Domain field, select the domain.
-
Select Submit.
-
-
Add a capability override.
-
Select the Capability Overrides tab, and then select New.
-
In the Capability field, select the capability.
-
In the Override Value field, enter the value for the capability.
-
In the Description field, enter a description of the override.
-
In the Domain field, select the domain.
-
Confirm that Active is selected.
-
Select Submit.
-
-
Add a connector scope.
-
Select the Policy Connector Scopes tab, and then select New.
-
In the Connector Scope field, select the connector scope.
-
Select Active.
The Active check box is cleared by default. If you don't select it, the connector scope doesn't take effect.
-
Select Approval gate to require user approval before each action that uses the scope.
-
In the Domain field, select the domain.
-
Select Submit.
-
-
Add a file type rule.
-
Select the Policy File Type Rules tab, and then select New.
-
In the File Type Rule field, select the file type rule.
-
In the Domain field, select the domain.
-
Select Submit.
-
-
Select Update.
Result
The policy includes the components you added, and Arc enforces them for every user that the policy's user criteria covers.
Parent Topic:Configuring ServiceNow Arc
---
title: Configure a ServiceNow Arc agent policy
description: Add tool gates, approval patterns, network rules, sandbox rules, capability overrides, connector scopes, and file type rules to a policy to control what Arc can do for the users the policy applies to.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/application-development/configure-cowork-agent-policy.html
release: australia
topic_type: task
last_updated: "2026-09-29"
reading_time_minutes: 2
keywords: [policy, tool gates, approval patterns, network rules, sandbox rules, capability overrides, connector scopes, file type rules]
breadcrumb: [Configure, ServiceNow Arc, Extend, AI Workflow Factory Prime, Agentic app development, Building applications]
---
# Configure a ServiceNow Arc agent policy
Add tool gates, approval patterns, network rules, sandbox rules, capability overrides, connector scopes, and file type rules to a policy to control what Arc can do for the users the policy applies to.
## Before you begin
Create the policy. For more information, see [Create a ServiceNow Arc agent policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/application-development/create-cowork-agent-policy.md).
Role required: sn\_app\_arc.admin
## About this task
Each tab on a policy record links existing rule records to the policy. Add only the components you need. The number on each tab shows how many records are linked to the policy.
You can't edit or delete the **Default Policy**, or add rules to it. To change its behavior, create a policy with a lower priority number.
When you use a policy to override the **Default Policy**, add only the rules you want to change. Anything you don't add keeps coming from the **Default Policy**.
You can also manage policies and their rules in AI Control Tower. For more information, see [Manage Arc agent policies in AI Control Tower](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/application-development/manage-arc-policies-aict.md).
## Procedure
1. Navigate to **All** > **ServiceNow Arc** > **Policies** > **Arc Agent Policy**.
2. Open the policy you want to configure.
3. Add a tool gate.
1. Select the **Policy Tool Gates** tab, and then select **New**.
2. In the **Tool Gate** field, select the tool gate.
3. In the **Domain** field, select the domain.
4. Select **Submit**.
4. Add an approval pattern.
1. Select the **Policy Patterns** tab, and then select **New**.
2. In the **Approval Pattern** field, select the approval pattern.
3. In the **Domain** field, select the domain.
4. Select **Submit**.
5. Add a network rule.
1. Select the **Policy Network Rules** tab, and then select **New**.
2. In the **Network Rule** field, select the network rule.
3. In the **Domain** field, select the domain.
4. Select **Submit**.
6. Add a sandbox rule.
1. Select the **Policy Sandbox Rules** tab, and then select **New**.
2. In the **Sandbox Rule** field, select the sandbox rule.
3. In the **Domain** field, select the domain.
4. Select **Submit**.
7. Add a capability override.
1. Select the **Capability Overrides** tab, and then select **New**.
2. In the **Capability** field, select the capability.
3. In the **Override Value** field, enter the value for the capability.
4. In the **Description** field, enter a description of the override.
5. In the **Domain** field, select the domain.
6. Confirm that **Active** is selected.
7. Select **Submit**.
8. Add a connector scope.
1. Select the **Policy Connector Scopes** tab, and then select **New**.
2. In the **Connector Scope** field, select the connector scope.
3. Select **Active**.
The **Active** check box is cleared by default. If you don't select it, the connector scope doesn't take effect.
4. Select **Approval gate** to require user approval before each action that uses the scope.
5. In the **Domain** field, select the domain.
6. Select **Submit**.
9. Add a file type rule.
1. Select the **Policy File Type Rules** tab, and then select **New**.
2. In the **File Type Rule** field, select the file type rule.
3. In the **Domain** field, select the domain.
4. Select **Submit**.
10. Select **Update**.
## Result
The policy includes the components you added, and Arc enforces them for every user that the policy's user criteria covers.
**Parent Topic:**[Configuring ServiceNow Arc](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/application-development/servicenow-cowork-configuring.md)
| title | Configure a ServiceNow Arc agent policy |
| description | Add tool gates, approval patterns, network rules, sandbox rules, capability overrides, connector scopes, and file type rules to a policy to control what Arc can do for the users the policy applies to. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/application-development/configure-cowork-agent-policy.html |
| release | australia |
| topic_type | task |
| last_updated | 2026-09-29 |
| reading_time_minutes | 2 |
| keywords | policytool gatesapproval patternsnetwork rulessandbox rulescapability overridesconnector scopesfile type rules |
| breadcrumb | ConfigureServiceNow ArcExtendAI Workflow Factory PrimeAgentic app developmentBuilding applications |