SNOW-AF-11: Agent Tool Can Change a System of Record
🔴 High · ServiceNow Action Fabric
Detects an AI Agent Studio tool whose operation, Flow, or script can create, update, or delete records in a system of record. High; critical for deletes. This is about reach. SNOW-1.1 is the separate check for running that tool without a person confirming it.
Details
| Field | Value |
|---|---|
| Rule ID | SNOW-AF-11 |
| Severity | High |
| Category | ServiceNow Action Fabric |
Remediation
Narrow the tool to the one table and operation it needs, prefer read tools for lookups, and keep deletes off any tool an agent can call on its own.