ServiceNow AI Control Tower 2026: Enterprise Kill Switches for Rogue AI Agents

In 9 seconds, an AI agent with elevated permissions deleted an entire production database — customer records, reservations, every backup, gone.

That incident, which circulated through enterprise security channels in early 2026, crystallized the governance problem that has been building since agentic AI moved from demos to production systems: agents are being deployed faster than organizations can control them. Gartner now projects that 40% of agentic AI projects will fail by 2027 — not because the AI cannot do the work, but because it cannot be controlled when it goes wrong.

On May 5, at its Knowledge 2026 conference, ServiceNow responded with the most comprehensive enterprise AI governance announcement to date: an expanded AI Control Tower with real-time kill switches, 30 new enterprise connectors spanning every major hyperscaler and business application, a Veza-powered identity access governance layer, and continuous AI observability through its Traceloop acquisition. This guide covers what was announced, how the kill switch works in practice, and what it means for teams building agentic AI in production.

Try it yourself: Free AI Token Counter — free, no signup, runs in your browser.

The Governance Gap ServiceNow Is Targeting

The governance problem in enterprise agentic AI has three distinct layers, and most existing tooling addresses only one of them.

The first layer is visibility. Before you can govern AI agents, you need to know they exist. Most enterprises deploying AI in 2026 have agents proliferating across AWS Bedrock, Azure OpenAI, Google Vertex AI, and direct API integrations — often without a single team having a complete inventory. ServiceNow’s research presented at Knowledge 2026 found that the median enterprise had 40% more AI agents running in production than its IT team believed. Shadow AI — the enterprise equivalent of shadow IT — is accelerating as business units deploy agents without central oversight.

The second layer is access control. Agents that read and write to enterprise systems — CRMs, ERP platforms, databases, communication tools — frequently hold dangerous permission sets. The principle of least privilege, fundamental to human identity access management, has rarely been applied rigorously to AI agents. An agent that needs to read customer records to answer support queries does not need write permissions to delete them. In practice, agents are over-permissioned because scoping permissions correctly requires understanding exactly what each agent does — which requires the observability infrastructure most teams have not built.

The third layer is enforcement. Even organizations with good visibility and correct access policies often have no mechanism to act on them in real time. If an agent begins behaving unexpectedly — looping, accumulating permissions, generating destructive outputs — the response is typically manual investigation after the fact. The 9-second database deletion happened because there was no automated mechanism to interrupt the agent once it started executing. The full breakdown of that incident is covered in the PocketOS database deletion analysis, and it remains the clearest illustration of what ungoverned agent access looks like at runtime.

What ServiceNow Announced at Knowledge 2026

The original AI Control Tower, first announced in 2025, was primarily a visibility tool: it discovered AI assets, assessed their risk posture, and produced reports. The Knowledge 2026 expansion adds enforcement across five domains: discovery, observation, governance, security, and measurement.

Discovery: Finding Every Agent in the Enterprise

The updated discovery engine automatically catalogs AI assets across an enterprise regardless of where they run — every model, agent, dataset, and MCP server, including those deployed on AWS, Azure, and Google, and direct Anthropic and OpenAI API integrations. Coverage extends to 30 new enterprise connectors spanning SAP, Oracle, Workday, and other major business applications.

Critically, this discovery requires no agent-side instrumentation. Agents do not need to be modified or tagged — Control Tower finds them by monitoring network traffic, API calls, and platform-level metadata. For enterprises that have been unable to produce a clean count of deployed AI agents, this passive discovery is the baseline capability everything else depends on. You cannot kill a rogue agent you do not know exists.

The Kill Switch: What It Actually Does

When the AI Control Tower detects suspicious activity — an agent calling tools it has no business calling, accumulating permissions, or generating outputs that deviate significantly from its defined behavioral profile — it surfaces an alert and presents a kill switch action.

Activating the kill switch executes four operations in sequence:

1. Revokes the agent’s model and tool access via the ServiceNow AI Gateway
2. Deactivates the agent instance
3. Generates a P1 security incident with the full event timeline
4. Produces a complete audit trail of every action the agent took before termination, including every LLM call made and every tool invoked

The implementation is intentionally not fully automated. ServiceNow made the design decision that kill switch execution — because it interrupts live business processes — requires human confirmation. What is automated is detection and escalation; what requires human judgment is the termination decision itself. This positions the system as an augmentation for incident response rather than autonomous enforcement — likely the correct trade-off for a first-generation product, given the consequences of false positives on production workloads.

The blast zone concept that ServiceNow leadership emphasized throughout Knowledge 2026 is central here: the kill switch does not just stop the agent, it also revokes the permissions that define the blast zone. An agent shut down but still holding write access to a production database is a security incident waiting to resume. Revoking access atomically with deactivation is what makes the kill switch meaningful rather than cosmetic.

Identity Access Governance via Veza

The access control layer comes from ServiceNow’s integration with Veza, whose patented access graph technology maps relationships between identities and resources. In the AI governance context, Control Tower can now answer questions that were previously very difficult: which agents have write access to which databases, which agents share permission sets with flagged human identities, and which agents have acquired permissions since they were initially deployed.

Veza’s access graph extends to every connected device, agent, model, and action within the enterprise environment, including hyperscaler AI environments. This matters because permission drift — agents gradually acquiring access they should not have — is one of the primary mechanisms by which agentic AI creates unintended risk over time. Agents that start with read-only access accumulate write permissions through workflow integrations, and without an identity graph that tracks this drift in real time, the accumulated permissions become invisible until something goes wrong.

AI Observability Through Traceloop

ServiceNow acquired Traceloop in March 2026, and Knowledge 2026 was the first public integration of Traceloop’s technology into the Control Tower. Traceloop tracks every LLM call running in the system — the model called, the prompt sent, the response received, the latency, and the downstream action taken — replacing periodic manual audits with continuous runtime monitoring.

Anomaly detection runs against the LLM call stream in real time. An agent that normally makes three tool calls per workflow and suddenly makes thirty will surface before the downstream impact materializes. Combined with the kill switch, this creates a detect-and-respond capability that is qualitatively different from anything available in enterprise AI governance tooling before May 2026. The instrumentation patterns that Traceloop-style monitoring depends on — structured logging of every agent action, the input, the model called, the output, and the downstream effect — are covered in depth in the AI agent observability and production monitoring guide.