Exploring policies in AI Control Tower

Learn how policies let you automatically respond to detected AI threats, block AI usage outright, or control what Arc can do on your users' devices, and where policies are enforced across AI Control Tower.

Policies overview

Blocking a rogue AI agent or containing a detected threat typically involves writing custom scripts, or reacting to an issue that's often discovered well after it has occurred. These approaches don't scale past a handful of one-off exceptions, and they don't hold up consistently across every platform your organization runs AI on.

Policies address this by letting you define that governance once, as a reusable rule, instead of reacting case by case.

Respond automatically when a detected threat, such as a prompt injection or excessive data exposure, crosses a threshold you define.
Stop a specific AI agent, model, or domain from being used, without writing a flow.
Control which tools, network destinations, and files Arc can use, and which of its actions wait for a person's approval.
Preview which requests a policy would affect before publishing it.
See exactly which policy blocked or allowed a given request, and why.

Policy users

User	Description
AI steward	Creates, edits, clones, and deletes Threat Response and Explicit Block policies, and reviews policy enforcement activity to confirm policies are working as expected.
AI steward with the Arc admin role	Creates, edits, and deletes Arc policies and the rules in them.

Policy types

Each policy type suits a different governance need.

Threat Response

Watches for a specific threat category, such as sensitive data disclosure or prompt injection, crossing a threshold you define (for example, more than 50 detections in 10 minutes). When triggered, deactivates the affected agent, and can create a ticket for a team or notify a group. The affected agent stays offline until it's reinstated. For details, see Threat Response policies.
Explicit Block

Stops a user, a department, or everyone from using a specific AI agent, model, or domain. Once initiated, the block stays in effect until the policy is deleted. For details, see Explicit Block policies.
Arc

Shapes what ServiceNow Arc can do on users' devices, such as which tools it can call, which hosts it can reach, and which actions wait for approval. Each policy layers over the default Arc policy for the users it covers. For details, see Arc policies.

Policy enforcement points

Policies are evaluated and enforced at points throughout your organization.

Agent Client Collector (ACC)

Blocks and unblocks AI agents by model or domain, through ACC's AI governance policy.
Cloud-hosted agent platforms

Amazon Bedrock, Amazon Bedrock AgentCore, Azure AI Foundry, and Gemini Enterprise Agent Platform agents. Each platform is enforced through its own native access control, so the same rule reaches an agent no matter which of these it runs on.
Okta

Blocks and unblocks a person's access through their Okta-managed identity.
ServiceNow agents

Blocks and unblocks AI agents hosted by ServiceNow.

For a complete list, see Control enforcement points.

Policies workflow

This infographic shows a sample end-to-end workflow of the AI steward sets up policy enforcement points, creates policies, and reviews enforcement activity.

[Omitted image "mmasset0022400-policies-workflow-ai-control-tower-vertical.svg"] Alt text: Infographic showing policy enforcement configuration and actions taken by the AI steward. For details, refer to the following description.

In this workflow:

The AI steward configures one or more control enforcement points.
The AI steward creates a Threat Response policy and defines the threat category, its scope, and the threshold that triggers a response.
The AI steward creates an Explicit Block policy and defines who is blocked and what they're blocked from using.
Once published, the policy is enforced at whichever connected points apply.
The AI steward reviews enforcement activity to confirm the policy is working as expected.

Policies benefits

Benefit	Feature	Users
Respond automatically to a detected threat before it spreads further.	Create a Threat Response policy	AI steward
Stop specific AI usage outright, without writing a flow.	Create an Explicit Block policy	AI steward
Give specific groups different Arc behavior, without changing the default for everyone.	Managing ServiceNow Arc policies in AI Control Tower	AI steward with the Arc admin role
Confirm a policy is working as expected.	Reviewing policy enforcement activities in AI Control Tower	AI steward

What to explore next

To learn more about configuring and using Policies, see:

title	Exploring policies in AI Control Tower
description	Learn how policies let you automatically respond to detected AI threats, block AI usage outright, or control what Arc can do on your users' devices, and where policies are enforced across AI Control Tower.
locale	en-US
canonical_url	https://www.servicenow.com/docs/r/intelligent-experiences/gov-pol-exploring.html
release	brazil
topic_type	concept
last_updated	2026-09-10
reading_time_minutes	4
keywords	ServiceNow OttoAI Agentsgenerative AIagentic AIexplore
breadcrumb	Controlling AI asset usageGovern AI assetsAI Control TowerEstablishing AI governanceEnable AI Experiences