SNOW-20.3: Agent runAs Falls Back to System Administrator

🚨 Critical · ServiceNow Excessive Agency

Detects ServiceNow AI Agent / Flow / script configurations whose runAs / execution identity falls back to a hardcoded System Administrator user sys_id when the intended user is missing.

Details

Field	Value
Rule ID	SNOW-20.3
Severity	Critical
Category	ServiceNow Excessive Agency
Platforms	servicenow

Remediation

Remove hardcoded System Admin sys_id fallbacks. Fail closed when the acting user is absent, or run as a least-privilege integration user with Role Masking.

See Also

• Rule catalog index
• Scanning basics
• SARIF output