Security Rules Reference
112 rules across 72 categories — 🚨 39 critical, 🔴 65 high, 🟡 8 medium.
Action Configuration
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-1.2 | 🔴 High | Schema Synchronization Verification | Detects when schema |
Agent Script Safety
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-2.3 | 🔴 High | Prompt Injection Defense Heuristics | Detects when dynamic user input variables are injected into prompt templates or agent instructions without defensive boundary patterns, creating vulnerability to prompt injection attacks that can override system instructions and bypass security policies |
AGENTFORCE-2.1 | 🟡 Medium | Validation Guard Clause Enforcement | Detects when Agent Script invokes state-modifying actions (Apex/Flow targets) without preceding validation logic such as conditional guards or available_when clauses |
MuleSoft Agent Fabric
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-AF-01 | 🚨 Critical | Broker PII Routing Without Guard | Detects Agent Fabric brokers that route requests to agents processing PII-classified fields without PII output guards |
AGENTFORCE-AF-02 | 🔴 High | LLM Provider Without Rate Limit | Detects LLM provider configurations in Agent Fabric that lack rate limiting controls |
AGENTFORCE-AF-03 | 🔴 High | A2A Card Overpermissioned Scope | Detects A2A Agent Cards that advertise sensitive capabilities (database writes, deployments, payments) without requiring strong authentication (mTLS, OAuth2) |
AGENTFORCE-AF-04 | 🔴 High | Broker Privilege Escalation via Routing | Detects Agent Fabric brokers with routing strategies (fallback, round-robin) that route across agents at different privilege levels |
AGENTFORCE-AF-05 | 🟡 Medium | Bidirectional Agent Communication Without Broker | Detects agents in the Agent Fabric that can communicate bidirectionally (Agent A calls Agent B and Agent B calls Agent A) without a mediating broker to control the conversation |
Supply Chain Security
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-SC-01 | 🚨 Critical | Malicious API Downgrade Injection | Agentforce metadata requires sourceApiVersion 64 |
AGENTFORCE-SC-02 | 🔴 High | Silent Schema Desync Exploit | When a schema |
AGENTFORCE-SC-03 | 🟡 Medium | Managed Package Origin | Detects when AI agent actions invoke Apex classes or Flows from managed packages (third-party code) |
Agent Flow Integrity
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-2.2 | 🟡 Medium | Transition Integrity | Every agent topic should either transition to another topic or define actions that perform useful work |
AgentExchange Supply-Chain
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-SC-10 | 🚨 Critical | Tool Namespace Shadowing (Confused Deputy) | Detects when third-party AgentExchange plugins register tools with API names identical or similar to core Salesforce internal functions, or embed cross-origin shadowing directives in their description fields |
AGENTFORCE-SC-11 | 🔴 High | Unbound Gateway Activation | Detects agents active in Salesforce metadata but absent from Agent Fabric (Flex Gateway) governance policies |
AGENTFORCE-SC-12 | 🔴 High | Transitive Prompt Poisoning | Detects meta-prompting instructions in third-party plugin instruction definitions that attempt to override core system instructions or bypass enterprise guardrails |
Agentforce for Commerce
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-17.1 | 🚨 Critical | Commerce Agent Without Idempotency Key | Detects agent actions targeting Apex classes that make HTTP callouts to Commerce or Order Management APIs without including an Idempotency-Key header |
AGENTFORCE-17.2 | 🚨 Critical | Commerce Agent Amount Without Bounds Check | Detects Apex invocables called by Commerce agent actions that manipulate Amount, Quantity, or Price fields without validating bounds |
Agentic Architecture
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-7.1 | 🔴 High | Topic Action Bloat (God-Topic Prevention) | Detects Monolithic 'God Topics' configured with 5 or more actions |
AGENTFORCE-7.2 | 🔴 High | Inadequate Skill Semantics | Detects GenAiFunctions and Agent Actions with missing or dangerously brief (<20 chars) descriptions |
AGENTFORCE-7.3 | 🔴 High | Orphaned Bot Without AiEvaluationDefinition | Detects deployed Bots/BotVersions that have no corresponding AiEvaluationDefinition in the repository |
AGENTFORCE-8.1 | 🔴 High | Context Traversal Exfiltration (ForcedLeak Mitigation) | Detects Deep Object Graph Traversals in Agent Prompts |
Autonomous Scheduling
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-11.1 | 🚨 Critical | Unguarded Autonomous Scheduled Action | Detects agent actions that invoke Scheduled Apex or Batch Apex without requiring user confirmation |
AGENTFORCE-11.2 | 🔴 High | Time-Window Privilege Drift | Detects Scheduled Apex classes invoked by agent actions that declare 'without sharing' and perform DML |
Custom Permission Enforcement
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-16.1 | 🔴 High | Agent Action Without Custom Permission Gate | Detects agent actions targeting Apex classes that perform DML on financially-sensitive objects (Opportunity, Order, Contract, Quote) without checking CustomPermission or FeatureManagement |
Data Cloud Grounding
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-13.1 | 🚨 Critical | RAG Knowledge Source Without Schema Classification | Detects GenAiPromptTemplates that reference fields without SecurityClassification tags |
Data Exfiltration
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-21.1 | 🚨 Critical | PII/PHI Payload Leakage in Tool Output | Detects when agent actions invoke Apex classes that query Salesforce objects containing fields classified as PII, PHI, CCPA, GDPR, HIPAA, or PCI |
Data Exfiltration / Injection
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-21.2 | 🔴 High | Insecure Output Handling (Agent-to-XSS) | Detects Flow screens targeted by agent actions that render LLM-generated output without sanitization |
Einstein Copilot Studio Configuration
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-12.1 | 🚨 Critical | Latent Memory Poisoning in Prompt Template | Detects GenAiPromptTemplates that use Conversation Memory ({!Conversation |
AGENTFORCE-12.2 | 🚨 Critical | GenAiPlannerBundle API Version Drift | API v64 |
Excessive Agency
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-1.1 | 🚨 Critical | Mandatory User Confirmation | GenAiFunction actions that invoke Apex or Flow backend logic must require user confirmation to prevent the AI agent from autonomously executing side-effects |
AGENTFORCE-20.1 | 🚨 Critical | DML Bypassing FLS in Invocable Actions | Detects Apex classes invoked by AI agent actions that perform DML operations (insert/update/delete/upsert/merge) without enforcing Field Level Security (FLS) |
AGENTFORCE-20.2 | 🚨 Critical | Unconstrained ModifyAllData in Agent Context | Detects agent actions configured to run in system context (ModifyAllData equivalent), granting the LLM planner org-wide data access without user-scope constraints |
SNOW-20.2 | 🚨 Critical | Role Masking Not Configured for Dynamic User Agent | Validates that AI Agents using Dynamic User identity mode have Role Masking properly configured |
External Service Security
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-15.1 | 🔴 High | External Service Without Certificate Pinning | Detects Named Credentials used for external service calls that lack certificate pinning (useClientCertificate = false) |
AGENTFORCE-15.2 | 🔴 High | Dynamic Cloaking via External RAG Source | Detects GenAiPromptTemplates that ground against external data sources not in the project's trusted grounding allowlist |
Governance
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-4.3 | 🔴 High | Synthetic Evaluation Completeness | Enforces that all deployed GenAiPlannerBundles possess corresponding AiEvaluationDefinition test suites |
Graph: Cascading Automation
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-32.1 | 🔴 High | Unintended Autonomous Blast Radius | [Enterprise] Detects when an agent-triggered DML operation on an SObject fires an ApexTrigger that dispatches async jobs (Future/Queueable) with external HTTP callouts |
Graph: Component Injection
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-34.1 | 🚨 Critical | Agent-to-UI XSS (Component Injection Graph) | [Enterprise] Performs 4-hop graph traversal proving an LLM-generated string travels from agent output through a Flow screen variable into an LWC component that renders it via unsafe innerHTML or lwc:inner-html without sanitization |
Graph: MCP Identity Mismatch
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-33.1 | 🔴 High | MCP Over-Provisioning | [Enterprise] Detects MCP server configurations where the authorizing Connected App has full-scope OAuth access (full/api/chatter_api) disproportionate to the MCP tool's stated narrow purpose |
Graph: PII Exfiltration Path
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-30.1 | 🚨 Critical | Context Window PII Poisoning (Graph) | [Enterprise] Performs 4-hop graph traversal to prove regulated data (PII/PHI/GDPR/HIPAA/PCI) travels from a classified CustomField through an Apex query, agent action invocation, and into an LLM PromptTemplate context window |
Graph: Privilege Escalation Path
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-31.1 | 🚨 Critical | Autonomous Without-Sharing Escalation (Deep) | [Enterprise] Detects 4-hop privilege escalation: a guest/Community-accessible agent topic whose action targets a System-mode Flow that invokes a without sharing Apex class |
Grounding Security
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-3.1 | 🚨 Critical | Hardcoded Sensitive Indicators | Detects hardcoded API keys, OAuth tokens, passwords, PII patterns (SSN, credit cards), private keys, and internal URLs in prompt template text and plugin instructions |
AGENTFORCE-3.2 | 🚨 Critical | Field-Level Security Masking Alignment | Dynamically verifies that custom fields referenced in Prompt Templates possess a SecurityClassification tag |
Headless MCP Access
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-MCP-01 | 🚨 Critical | Token Passthrough Exposure Configuration | Detects MCP server configurations using static OAuth client IDs without PKCE enforcement, missing Device Authorization Grant patterns, or lacking Flex Gateway routing policies |
AGENTFORCE-MCP-02 | 🚨 Critical | Broad Scope DevOps Pipeline Inheritance | Detects when external coding agents (Cursor, Claude Code, Windsurf) are granted access to DevOps Center MCP deployment tools targeting production environments without explicit deterministic approval gates |
AGENTFORCE-MCP-04 | 🚨 Critical | MCP Tool Definition Drift (Rug Pull Detection) | Detects when MCP tool definitions (descriptions, parameters, schemas) have changed since the last certified scan — indicating a potential Rug Pull attack where a trusted MCP server silently updates its behavior |
AGENTFORCE-MCP-03 | 🔴 High | Missing Protocol Scope Constraints | Detects MCP server configurations with wildcard scopes, missing scope definitions, or high-privilege tool exposure without namespace isolation |
AGENTFORCE-MCP-05 | 🔴 High | Shadow MCP Server Detection | Detects MCP servers configured in |
AGENTFORCE-MCP-06 | 🔴 High | MCP Schema Parameter Injection | Detects manipulation of JSON Schema definitions for MCP tool and GenAiFunction parameters |
AGENTFORCE-MCP-07 | 🔴 High | MCP Server Network Exposure | Detects MCP servers configured with non-localhost bind addresses (0 |
Injection
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-FLOW-03 | 🔴 High | Variable Injection in DML | Dynamic AI input directly evaluates inside a Flow Object Filter, risking SOQL injection |
Instruction Integrity
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-9.1 | 🚨 Critical | Metadata Instruction Poisoning | Detects adversarial content patterns in metadata instruction fields (GenAiPlugin instructions, GenAiFunction descriptions, Agent Script systemInstructionOverrides, PromptTemplate content) that could manipulate the LLM planner into performing unauthorized actions |
AGENTFORCE-9.2 | 🔴 High | Cross-Topic Instruction Boundary | Detects when a topic's instruction text references another topic's name or attempts to override the planner's topic-selection logic |
MCP Authentication
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-24.2 | 🔴 High | Missing Signature Validation on Agent Webhook | Detects @RestResource Apex endpoints accessible to agent actions that do not implement HMAC signature verification |
Multi-Agent Orchestration
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-18.1 | 🚨 Critical | Compositional Fragment Trap Risk | Detects partial instruction fragments across multiple GenAiPlugins that, when combined by the GenAiPlannerBundle, may reconstitute a complete override instruction not visible in any individual topic (ref: SSRN-6372438 'Compositional Fragment Traps') |
AGENTFORCE-18.2 | 🔴 High | Sybil Identity in Multi-Agent Orchestration | Detects duplicate Bot labels or descriptions within a project's agent orchestration |
SNOW-18.2 | 🔴 High | Yokohama Agent Duplication Sybil | Detects duplicated AI Agent definitions that share tool references (sn_aia_agent_tool_m2m) |
Network Security
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-API-01 | 🔴 High | External Callout Injection | AI Input mapped directly into an external API structure risks Server Side Request Forgery (SSRF) or Data Leakage |
OpenGraph Security
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-OG-01 | 🔴 High | OGP Metadata Prompt Injection | Detects prompt injection patterns embedded in Open Graph Protocol metadata (og:description, og:title) on URLs referenced by agent actions, MCP tools, or prompt template data providers |
AGENTFORCE-OG-03 | 🔴 High | Attractive Metadata Attack via OGP | Detects 'Attractive Metadata Attacks' (NeurIPS 2025) where OGP metadata on MCP server or tool endpoints contains language designed to manipulate LLM tool-selection mechanisms |
AGENTFORCE-OG-02 | 🟡 Medium | A2A Agent Card / OGP Trust Mismatch | Detects mismatches between an agent's A2A Agent Card capabilities and its Open Graph metadata description |
Operational Reliability
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-10.1 | 🟡 Medium | Validation Rule Conflict | Detects when AI agent actions target Salesforce objects that have validation rules which could silently reject DML operations |
Orchestration Integrity
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-4.1 | 🔴 High | Planner Orchestration Completeness | GenAiPlannerBundle must reference only GenAiPlugins and GenAiFunctions that exist in the workspace |
Platform Event Security
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-19.1 | 🚨 Critical | Sub-agent Spawning via Platform Event | Detects agent actions that publish Platform Events where a Platform Event Trigger on that event type invokes another agent session or GenAiFunction |
AGENTFORCE-19.2 | 🔴 High | CDC Without Field Filter in Agent Context | Detects Change Data Capture triggers that deliver unfiltered field changes to agent contexts |
Privilege Escalation
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-FLOW-01 | 🚨 Critical | System Context Enforcement | Agent invokes a Flow running in SystemModeWithoutSharing, bypassing all profile security bounds |
AGENTFORCE-1.3 | 🔴 High | Target Context Privilege Analysis | Apex classes invoked by Agentforce actions must enforce sharing rules |
Prompt Injection
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-PT-01 | 🚨 Critical | Template Context Poisoning | Unmasked Agent input is directly rendered into a GenAI Prompt Template content block |
Resource Exhaustion
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-23.1 | 🔴 High | Non-Selective SOQL in Agent Tools (Agent DoS) | Detects Apex classes invoked by agent actions that contain SOQL queries without LIMIT clauses |
Runtime Capability Drift
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-RD-01 | 🔴 High | Headless Confirmation Bypass (Experience Layer) | Detects when high-privilege agent actions (DML, Apex deployment, permission modification, financial transactions) can be invoked through headless Headless 360 endpoints without a deterministic Agent Script transition requiring an Experience Layer approval card |
AGENTFORCE-RD-03 | 🔴 High | PII Output Bypass in Headless Transmissions | Detects GenAiFunction actions whose output references objects with FLS-designated sensitive fields (PII, financial data) when no Agent Fabric PII Detector policy covers the agent |
AGENTFORCE-RD-04 | 🔴 High | Headless PII Route Validation | Validates that all agent output paths involving PII-sensitive fields are routed through Agent Fabric policies with both PII detection and prompt guard enforcement |
AGENTFORCE-RD-02 | 🟡 Medium | Variable State Condition Evasion | Detects when security-critical ConversationContextVariables (authentication status, user clearance, financial limits) are declared in the AiAuthoringBundle but never referenced in deterministic Agent Script transition conditions (-> if @variables |
SSRF
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-22.1 | 🚨 Critical | Unsafe Autonomous HTTP Callouts | Detects Apex classes invoked by agent actions that make HTTP callouts to dynamically-constructed endpoints without Named Credential enforcement |
Security Configuration
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-PT-02 | 🔴 High | Experimental Template Activation Exposure | Detects when a Prompt Template is configured for global Allowed access without explicit evaluation or safety constraints |
ServiceNow ACL
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-28.1 | 🚨 Critical | ACL Script Using GlideRecord (Recursive Bypass) | Detects GlideRecord usage in ACL scripts and agent-facing tool scripts |
SNOW-28.6 | 🔴 High | addEncodedQuery Without User Context Restriction | Detects use of addEncodedQuery() in agent-facing scripts where addUserEncodedQuery() should be used |
ServiceNow API Authentication
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-24.1 | 🔴 High | Agent API Endpoint Without OAuth Scope Validation | Detects Scripted REST APIs and Now Assist API endpoints accessible to AI agents that lack OAuth entity scope validation |
ServiceNow Agent Architecture
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-7.1 | 🟡 Medium | Agent Instruction Bloat | Detects sn_aia_agent definitions with excessively large or poorly structured instruction fields |
ServiceNow Autonomous Scheduling
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-11.1 | 🔴 High | Scheduled Job Invoking Agent Without Guardrail | Detects scheduled jobs and background scripts that invoke AI Agents without execution guardrails, risking sub-agent spawning and resource exhaustion |
ServiceNow Data Exfiltration
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-21.1 | 🚨 Critical | Agent Script Accessing Sensitive Table Without Privacy Guard | Detects agent-accessible scripts that query sensitive ServiceNow tables (sys_user, sys_user_has_role, cmdb_ci, incident, hr_case, sys_attachment) without data privacy classification guards |
ServiceNow Data Privacy
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-13.1 | 🔴 High | Agent Accessing Classified Data Without Privacy Guard | Detects agent scripts accessing tables with sys_dictionary data_privacy classifications without enforcing privacy guards |
ServiceNow Domain Separation
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-29.1 | 🔴 High | Domain Separation Drift (Missing sys_domain) | Detects GlideRecordSecure queries in agent-facing scripts that lack sys_domain constraints |
ServiceNow Excessive Agency
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-20.1 | 🚨 Critical | Agent Executing With Admin Privileges | Detects AI Agent configurations where the execution identity has admin role or the agent scripts use GlideRecord without Role Masking, granting unrestricted database access |
ServiceNow External Service
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-15.1 | 🔴 High | Integration Spoke Without Certificate Pinning | Detects IntegrationHub spoke configurations linked to AI agent flow actions that lack certificate pinning or use basic authentication |
ServiceNow Flow Security
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-5.1 | 🔴 High | Flow Action Without Input Validation | Detects Flow Designer actions (sys_hub_action) and subflows linked to AI agents that lack input validation or execute in system context |
ServiceNow Grounding Security
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-3.1 | 🔴 High | Grounding Source Without Classification | Detects AI Search grounding sources and RAG configurations that lack data classification guards |
ServiceNow Instruction Integrity
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-9.1 | 🚨 Critical | Prompt Injection Vector in Agent Instructions | Detects prompt injection vectors in sn_aia_agent instructions, NASK skill markdown, and inbound email action scripts |
ServiceNow MCP Access
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-25.1 | 🔴 High | MCP Server Without Scope Constraints | Detects MCP server configurations (echelon-ai-labs or native) accessible to ServiceNow AI Agents without protocol scope constraints or tool filtering |
ServiceNow MID Server Trust
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-31.1 | 🚨 Critical | MID Server / Discovery Trust Violation | Detects insecure MID Server integration patterns including Basic Auth usage, hardcoded credentials, missing mTLS/OAuth, and arbitrary command execution patterns |
ServiceNow Memory Safety
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-12.2 | 🚨 Critical | Latent Memory Poisoning in Agent Memory | Detects suspicious instruction-like patterns embedded in sn_aia_memory records |
ServiceNow Multi-Agent
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-18.1 | 🔴 High | Multi-Agent Compositional Fragment Trap | Detects compositional fragment risks when multiple agents share tools or use cases (sn_aia_usecase) |
ServiceNow Operational Reliability
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-10.1 | 🔴 High | Agent DML Without Data Policy Guard | Detects agent-accessible scripts performing insert/update/delete operations on tables without corresponding Data Policy validation, risking data corruption |
ServiceNow Resource Exhaustion
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-23.1 | 🔴 High | Unbounded GlideRecord Query in Agent Script | Detects agent scripts executing GlideRecord queries without setLimit() or chooseWindow(), enabling resource exhaustion through unbounded result sets |
ServiceNow Role-Based Access
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-16.1 | 🔴 High | Agent Action Without Role Gate | Detects agent tool scripts that perform privileged operations without gs |
ServiceNow Runtime Drift
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-27.1 | 🚨 Critical | Now Assist API Confirmation Bypass | Detects Now Assist API integrations and headless execution paths that bypass tool confirmation requirements |
ServiceNow SSRF
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-22.1 | 🚨 Critical | SSRF via Dynamic RESTMessageV2 Endpoint | Detects agent scripts using sn_ws |
ServiceNow Scope Hygiene
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-30.1 | 🔴 High | Application Scope Hygiene Violation | Detects ServiceNow AI agents and tools operating outside their declared application scope |
ServiceNow Script Safety
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-2.1 | 🚨 Critical | Unsafe Script Pattern in Agent Tool | Detects unsafe scripting patterns in agent-accessible Script Includes and Script Tools |
ServiceNow Skill Kit
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-12.1 | 🔴 High | Skill Kit Version Drift | Detects sys_gen_ai_skill_applicability records with missing ACLs or version mismatches between skill definitions and agent configurations |
ServiceNow Structural Dependency
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-4.1 | 🔴 High | Orphaned Agent Tool Reference | Detects orphaned or broken references in sn_aia_agent_tool_m2m and sn_aia_usecase definitions |
ServiceNow Supply Chain
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-26.1 | 🔴 High | Skill Namespace Shadowing | Detects duplicate tool/skill labels across scoped applications that can confuse the AI agent's tool selection |
SNOW-6.1 | 🔴 High | Update Set Missing Agent Dependencies | Detects Update Sets containing AI Agent artifacts (sn_aia_*) with missing dependencies, unresolved sys_id references, or integrity violations |
ServiceNow Tool Configuration
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-1.1 | 🚨 Critical | Agent Tool Without Confirmation Gate | Detects sn_aia_tool definitions configured for autonomous execution (no user confirmation) when they perform operations with side-effects |
ServiceNow Trigger Execution
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-19.1 | 🔴 High | Business Rule Triggering Agent Execution | Detects Business Rules (sys_script) that invoke AI Agents |
ServiceNow Virtual Agent
| Rule ID | Severity | Name | Description |
|---|---|---|---|
SNOW-14.1 | 🔴 High | Virtual Agent Topic Without Input Sanitization | Detects Virtual Agent topics (sys_cs_topic), utterances, and topic-block scripts that process user input without sanitization |
Slack Integration Security
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-14.1 | 🔴 High | Slack Channel Bot Without DLP Guard | Detects Bots configured to operate in Slack channel contexts without Data Loss Prevention guards |
Structural Dependency
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-4.2 | 🔴 High | Component Deactivation Collision | Detects when a prompt template activation record sets accessLevel to 'Blocked' (deactivation) while the template is still referenced by other components |
Supply Chain: ToxicSkills
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-TS-01 | 🚨 Critical | Hidden Instruction in Markdown | Detects HTML comment blocks or CSS-hidden text in skill documentation (README |
AGENTFORCE-TS-02 | 🔴 High | Base64 Payload in Skill File | Detects Base64-encoded strings in markdown skill files whose decoded content matches adversarial instruction patterns or credential formats |
AGENTFORCE-TS-03 | 🔴 High | Zero-Width Unicode Injection | Detects zero-width Unicode characters (U+200B, U+200C, U+200D, U+FEFF) in markdown skill files |
Unauthorized Action
| Rule ID | Severity | Name | Description |
|---|---|---|---|
AGENTFORCE-FLOW-02 | 🔴 High | Silent State Modification via Flow | Action targets a Flow containing DML mutations but is invoked without human-in-the-loop confirmation |