Software vendors often sell AI with a simple calculation. Save every employee 10 minutes a day, multiply that across the workforce, and the investment appears to pay for itself. But that arithmetic assumes companies can turn those saved hours into measurable business results. Drafting a customer reply faster does not necessarily help a support team resolve more cases or lower operating costs.
Pat Casey hears that frustration directly from enterprise customers. The ServiceNow co-founder, chief technology officer, and executive vice president of DevOps believes the answer lies in moving beyond AI tools that help employees perform tasks toward systems that complete the work themselves. But giving AI greater autonomy also raises a more consequential question about how much authority companies should delegate to software.
“We are moving toward a world where AI performs more work autonomously. But that doesn’t mean companies should give these systems carte blanche to operate across their enterprises without oversight,” Casey tells me in an exclusive interview. “Automation presents a tremendous opportunity, but AI must operate under the same process controls, governance and auditing requirements that companies have established for human employees.”
ServiceNow has a substantial financial interest in making that transition possible. Its AI annual contract value surpassed $1 billion in the second quarter. The SaaS giant has introduced major enhancements to EmployeeWorks, making it easier for employees to build AI agents, alongside AI Passport, a credential designed to limit their authority.
As ServiceNow makes autonomous automation more accessible, it could also increase demand for the governance platform designed to keep those agents within approved boundaries.
EmployeeWorks Pushes AI Agents Beyond Assistance
Casey wants to move beyond generic agent frameworks that require engineers to adapt them to each customer’s business.
“Instead of coming in and saying, ‘I’ll figure out how your business does something,’ I want to say, ‘I’ve got an autonomous IT worker that performs the tasks an IT employee would handle.’ We’ll need to make some configuration changes and understand how your IT department operates, but the system will then close cases,” he says. “That’s a much harder engineering problem for us because we have to build considerably more of the underlying technology. For customers, though, it makes deployment much easier and helps them get value from the software faster.”
The newly announced EmployeeWorks capabilities remain in controlled availability, and ServiceNow has not disclosed their pricing. Within EmployeeWorks, Productivity Assistants let employees customize AI without writing code, subject to limits administrators set. Productivity Routines handle predictable, repeatable work in the background. Likewise, ToolSmith gives developers a conversational environment for building the tools those assistants use.
ServiceNow claims it trained the system on more than 75,000 application programming interfaces and designed it to use tokens efficiently. ToolSmith can review logs to suggest fixes and identify additional automation opportunities. The additions follow Flow, ServiceNow’s conversational service desk. Casey expects smaller IT teams to adopt Flow and larger customers to use it alongside existing workflows. He acknowledges overlapping capabilities across the portfolio, so customers still have to decide which product should handle a given task.
AI Passport Tackles Enterprise AI Agent Security
Employee-built agents raise a familiar security question about whose authority the software inherits. Casey points to unofficial automations that connect through administrator accounts, giving them far more access than their tasks require. In his deliberately exaggerated example, a tool built to close support cases also has enough privilege to fire CEO Bill McDermott.
“If an agent operates under your identity, I think we should fully support it because it makes you more productive, and the permissions and governance around your account should already be clear,” he says. “If it runs as an administrator, or under an identity other than your own, it is much more likely to require central governance. In that situation, the agent may be able to operate across organizational boundaries and cross security boundaries that would otherwise limit what you can do.”
AI Passport would give agents cryptographically signed credentials specifying what they can do. ServiceNow says its Super Intelligence Control Tower (SICT) would issue those credentials based on corporate policies and workflow approvals.
Nvidia is developing an implementation using its Open Agent Safety Platform, while ServiceNow describes interventions that can restrict or terminate agent activity. Moreover, Microsoft’s Agent 365 and Okta’s runtime gateway compete for similar authority. ServiceNow’s case for differentiation rests on connecting an agent’s access rights with the business rules governing its work. Its acquisition of Veza, which maps existing permissions, adds information about what those identities can actually access.
ServiceNow expects AI Passport in the fourth quarter, alongside shadow AI detection and AI Cost Management. Its announcement describes the underlying specifications as open but does not identify them. A signed credential can establish what an agent has permission to do, but the software handling its actions must enforce those limits.
Are AI-Native Competitors Reshaping ServiceNow’s Strategy?
Serval and Atomicwork challenge ServiceNow on deployment speed and cost. Serval also says its employee-facing agents can execute only automations administrators have approved, giving it a governance argument of its own.
Casey attributes some of his challengers’ confidence to their funding, which allows them to invest heavily in promoting alternatives to established platforms. But he also recognizes why the promise of a different approach gets customers’ attention. “They’re leaning very heavily on the idea that they have a new approach. When you look at our position, we agree that there are areas where a new approach is exactly where we should focus our time and energy. You can see that in our own product portfolio with offerings such as Flow. That represents a new approach for ServiceNow as well.”
ToolSmith similarly adopts the conversational development approach that challengers promote. AI can write code in widely used programming languages more readily than it can manipulate some proprietary metadata, the definitions that govern how enterprise applications behave. ServiceNow has consequently rewritten portions of its technology, including the interface engine behind parts of SICT.
“For many existing systems, the answer is that they already work well. There is no need to change them. Doing so would simply confuse customers, especially when you have a substantial installed base whose configurations already depend on that metadata,” says Casey. “But there are parts of those systems where you have to say, as we did, ‘We need to rewrite this.’ If we want AI to work effectively with those components, we have to change the underlying data structures and the physical structure it operates on, making the task easier for AI to perform.”
Enterprise AI Agents Need More Than Permission Controls
Even perfect permission enforcement cannot guarantee a desirable business outcome. Dave Wright, ServiceNow’s chief innovation officer, sees a broader “iteration trap” in companies using AI to accelerate employees’ work while continuing to rely on instinct for strategic decisions. He believes organizational digital twins could help executives simulate changes and evaluate their consequences before putting them into practice.
“For me to have confidence in an organizational digital twin, I would need to see a proven track record. I would want evidence that it could accurately predict the outcomes of past decisions where the organization already knows what happened. It would also need to communicate uncertainty honestly, provide wider ranges when the available data is limited, and clearly identify the assumptions influencing its predictions,” says Wright. “I would also expect independent validation from people who understand the business, along with a clear principle that the digital twin should inform decisions rather than make them independently.”
He believes organizations should expand an agent’s authority only after it demonstrates consistent performance within established boundaries. Giving employees the ability to build agents does not automatically give their managers the authority to govern workflows spanning multiple departments.
Wright says his proposed Chief Workflow Officer role is intended to expose a broader organizational problem, with many companies lacking clear accountability for managing enterprise workflows. A CIO could assume that responsibility, but only if the role expands beyond managing technology systems to overseeing business outcomes, with the CEO and COO granting meaningful authority across departments.
“The challenge is that many CIOs are not currently positioned to exercise that level of cross-functional responsibility. In some organizations, a chief human resources officer or chief operating officer may be better suited to the role, depending on how work moves through the business and where operational accountability sits,” he explained.
THE CONTROL LAYER VERDICT
ServiceNow is betting that enterprise AI’s next breakthrough will come from delegating more work to autonomous agents, not simply helping employees complete tasks faster. But easier automation also creates new responsibilities for managers, who must determine when agents deserve greater autonomy and when intervention is necessary. The company benefits from selling both autonomy and its controls. Ultimately, the real test is whether AI delivers measurable business value without creating an equally costly layer of supervision.
