What ServiceNow AI Control Tower is, and the question it leaves open
ServiceNow AI Control Tower is the place a ServiceNow customer inventories, governs and measures every AI system the company runs, including agents built outside ServiceNow. ServiceNow announced it and made it generally available at Knowledge 2025 on 6 May 2025, alongside AI Agent Fabric, the communication layer that lets agents talk to other agents and tools over MCP and A2A.
A year later, on 5 May 2026, ServiceNow expanded it around five pillars. Discover finds AI across the estate through 30 new integrations with AWS, Google Cloud and Azure. Observe adds runtime tracing from the Traceloop acquisition. Secure brings identity and access governance from Veza and an AI Gateway for MCP traffic. Govern carries the risk, compliance and lifecycle workflows. Measure, in ServiceNow's words, "provides cost tracking and ROI dashboards." ServiceNow said the expansion would enter its Innovation Lab in May with general availability expected in August 2026.
That is a serious product, and for a company already running ITSM and CMDB on ServiceNow it is the obvious place to put an agent inventory. The question it leaves open is the one finance asks: when an agent under this console tries to pay for something, what refuses the payment? We went to the schema to find out rather than the brochure.
ServiceNow AI agents can already spend money
This is not a hypothetical exposure. ServiceNow ships agents whose documented job is to create orders. The Procurement product recommendation AI agent, per ServiceNow's documentation, "can browse the catalog and create orders" and routes to submission forms based on vendor status and dollar thresholds. The ITAM Purchase order creation agent creates purchase orders. In the developer SDK, one of the tool types an agent can be given maps straight to sc_cat_item, the service catalog item table, which is where ordering happens.
ServiceNow AI agents are built in AI Agent Studio and coordinated by AI Agent Orchestrator, both announced on 29 January 2025 and included at no additional cost for Pro Plus and Enterprise Plus customers at the time. Agents can run in copilot mode, where a person confirms each step, or autopilot, where they do not. The moment one of them runs in autopilot with a catalog or purchasing tool, it is an actor that can commit company money, and the governance question stops being about access and becomes about amount.
The same applies to agents ServiceNow does not own. AI Control Tower discovers agents on Bedrock, AgentCore, Gemini Enterprise, Azure AI Foundry and Salesforce. Many of those can reach a payment MCP server or a corporate card. Seeing them in an inventory is valuable. It is not the same as bounding what they spend.
What ServiceNow publishes about AI Control Tower pricing
ServiceNow does not publish a price list for AI Control Tower, and we found no list price in any ServiceNow press release or product page. Anyone quoting you a precise public number is quoting a partner estimate or a negotiated deal. Here is what can actually be sourced.
On 9 April 2026 ServiceNow announced new packaging that "spans AI assistance, agentic automation, and fully autonomous operations," with AI Control Tower named among the built-in components. The release names no tiers and no prices. Several licensing analysts describe the new tiers as Foundation, Advanced and Prime, replacing the old Standard, Pro, Pro Plus and Enterprise structure, and say AI Control Tower appears in every tier. That comes from secondary sources rather than ServiceNow, so confirm it on your own order form. Fortune reported in May 2026 that ServiceNow was offering AI Control Tower free for a year to qualifying customers, again a secondary report.
The consumption side is better documented. ServiceNow meters AI through assists, and its own documentation describes a 365-day burn-down model. CIO reported in May 2026 that assist usage is difficult for customers to predict. That matters for what follows, because the cost tracking inside AI Control Tower is mostly about this meter, the cost of running AI, not about what an agent spends once it is running.
How we measured what ServiceNow can express about agent spending
We use the same method on every vendor page: read the machine-readable model the vendor publishes, run two vocabulary passes over it, and run the same passes over a part of the same vendor's model that obviously handles money, so we know the method can see money when it is there. ServiceNow does not publish an unauthenticated instance dictionary, so we used the two public surfaces that describe its agent model in detail. Everything below was run on 18 September 2026 without logging in to anything.
Surface one is ServiceNow's own developer SDK, the @servicenow/sdk package family on npm at version 4.12.2, published 15 September 2026. Its AI agent plugin, dist/external-plugins/aiaf.js in @servicenow/sdk-api (179,890 bytes), declares every column an agent definition writes to the instance, across thirteen tables including sn_aia_agent, sn_aia_agent_config, sn_aia_tool, sn_aia_team, sn_aia_usecase, sn_aia_trigger_configuration and sn_aia_version. @servicenow/sdk-core adds 109 typed properties for agent authoring. The same package bundles 185 platform table schemas with 3,477 columns, which gives us a control in the same artifact.
Surface two is the ServiceNow documentation corpus ServiceNow publishes on GitHub for LLM consumption, the ServiceNow/ServiceNowDocs repository on the Australia branch. We scanned 268 AI Control Tower files (117,313 words), all 1,710 intelligent-experiences files (868,629 words), and 1,359 source-to-pay files (543,582 words) as the control.
The money pass looks for amount|currency|budget|spend|price|cost|payment|invoice|monetary|limit|dollar|purchase. The scope pass looks for merchant|vendor|supplier|allowlist|approval|approver|threshold|daily|monthly|cumulative. The claim this supports is precise: there is no spend-limit vocabulary in the shipped, documented agent model. A customer can always add a custom field, and a custom field is exactly the thing you would then have to build, test and enforce yourself.
We found 84 AI agent columns and not one is an amount
The AI agent plugin writes 84 columns to the instance. The money pass matched zero of them. The scope pass matched zero. There is no budget column on sn_aia_agent, no currency on sn_aia_tool, no approval threshold on sn_aia_usecase, no merchant or supplier field anywhere in the agent tables.
The 109 typed properties in the SDK core produced two money hits and one scope hit, and all three are false positives worth naming so nobody misreads them. limit is the maximum number of records a query returns. searchResultsLimit is the same idea for search. documentMatchThreshold is a semantic similarity score between 0 and 1. None of them has a unit of money.
The closest things to a control in the agent model are executionMode, which switches between copilot and autopilot, and max_auto_executions, which counts runs. Both are useful. Neither can express "this agent may spend 2,000 dollars a month with these three suppliers and anything above 500 needs a person." The documentation pass agrees: across 117,313 words of AI Control Tower documentation our cap-phrase search (spend limit, budget cap, per transaction, maximum amount, virtual card and similar) returned zero matches, and so did the full 868,629-word intelligent-experiences corpus.
Where the money words in AI Control Tower actually point
The AI Control Tower documentation does contain money words, 164 of them, a rate of 14.0 per 10,000 words. We read them in context, because a count on its own proves nothing. Every one is about visibility or value, not enforcement.
The clearest example is ServiceNow's own heading, "Control AI spend," which it defines as monitoring AI system costs, including token-level costs across model providers, "so spend is visible and predictable." The rest are project portfolio fields for planned, budgeted and actual cost on AI projects, a Value dashboard that computes amount saved from hours multiplied by an hourly rate, and "max skill calls per execution," which is a usage count. That is a good measurement toolkit for the cost of running AI and the return on it. It is looking at the other side of the ledger from an agent that is about to pay a vendor.
This is the same line we found at Google, where the Gemini Enterprise cap governs the consumption bill, and at Salesforce, where Agentforce Digital Wallet alerts on credits. ServiceNow draws it slightly further toward reporting: it tracks and forecasts the meter, and leaves the payment itself alone.
The two ServiceNow kill switches, and why neither is about money
"ServiceNow AI Control Tower kill switch" is one of the most searched phrases around the product, and it refers to two different features that are easy to confuse.
The AI Control Tower kill switch protocol contains a rogue agent. A threat response policy applies a Deny Resource policy on AWS Bedrock or AgentCore, Gemini Enterprise Agent Platform or ServiceNow itself, disables the agent through the Azure Resource Manager API on Azure AI Foundry, and can optionally have Okta refuse future tokens. It fires on seven threat categories: Agentic Goal Deviation, Data and Model Poisoning, Excessive Agency, Improper Output Handling, Prompt Injection, Sensitive Information Disclosure and System Prompt Leakage. That is a genuinely cross-platform containment capability and ServiceNow deserves credit for it. None of the seven triggers is an amount or a budget, so an agent that spends steadily within its tool permissions never trips it.
The AI Agents trigger kill switch stops runaway triggers that burn assists. Its defaults are 5 fires per record in 24 hours, 25 distinct records and 3 consecutive days, and it ships with kill_switch.mode set to warn_only, so it disables nothing unless an administrator changes it to enforce. It protects your ServiceNow consumption bill. It is not a ceiling on money the agent pays out.
A kill switch is a blunt version of the trade every vendor makes here: stop the agent acting rather than limit what it may commit. UiPath draws the line in a more granular place, capping tool calls per session through a policy check it actually calls budget, and we measured exactly what that check can and cannot express in UiPath agentic automation spend controls.
ServiceNow does model a money limit. It is on the approver, not the agent.
The most useful detail in the whole exercise is where a real money ceiling does exist in ServiceNow. In Sourcing and Procurement Operations, the sn_shop_approval_rule table has an Approval limit field of type Currency, documented as the maximum amount that can be approved by the authorized job codes. That is a proper, enforced, dollar-denominated limit.
It is keyed to a job code, meaning a human approver's role, and it runs on a purchase requisition inside ServiceNow procurement. Two consequences follow. First, it does not bound an agent: it bounds the person who approves what the agent requested, which only helps if every agent purchase flows through a requisition. Second, anything the agent pays for outside that flow never meets the rule at all. A SaaS renewal on a corporate card, a metered API bought over x402, an ad top-up, a cloud reservation or a supplier paid through a QuickBooks or NetSuite MCP connector all sit outside sn_shop_approval_rule.
So ServiceNow knows how to model a spending limit, and put it on the procurement object for humans. The agent object, where you would need it for autonomous spend, has none.
The control worked, so the zero is real
A zero from a regex is only meaningful if the same regex fires on money elsewhere in the same source. It does, hard. In the same SDK package, 19 of the 185 bundled tables matched the money pass across 75 columns. ast_contract matched 16 of its 86 columns, including payment_amount, total_cost and monthly_cost. sc_cat_item, the catalog table an agent tool can point at, matched 8 of 77, including price, list_price and recurring_price. alm_asset matched 6 of 74.
In the documentation the contrast is starker. The source-to-pay control corpus hit the money pass at 315.2 per 10,000 words, against 14.0 for AI Control Tower, a gap of more than twenty times, and it returned the cap phrases our agent corpora never did: maximum amount, per transaction, spend cap and virtual card. Its field tables carry 22 fields typed Currency. The AI Control Tower pages carry no structured field tables at all.
ServiceNow models money in depth wherever a human buys something. The agent model is where it is absent, and on the evidence that is a scoping decision rather than an oversight.
What AI Control Tower does well, honestly
This page is not an argument against buying AI Control Tower, and it would be inaccurate to present it as weak. It is, as far as we can tell, the broadest enterprise AI inventory on the market. It discovers agents across Microsoft, Google, AWS, Salesforce and Anthropic connectors and flags shadow AI. It carries risk and compliance content mapped to the EU AI Act and NIST AI RMF. It runs lifecycle approvals so an agent has an owner and a review before it goes live. It adds evaluations and runtime observability, an MCP gateway, and value dashboards, and it plugs into the CMDB and workflow engine most large US enterprises already run on.
If your question is which agents exist, who owns them, what they can reach and whether they have been reviewed, AI Control Tower answers it well. If your question is what a given agent is allowed to spend, with which counterparty, before a person has to sign off, it does not try to answer it. Those are different controls, and a mature program ends up with both.
Where a spend policy layer fits under AI Control Tower
The clean split is this: AI Control Tower governs whether an agent may exist and what it may reach, and a spend policy layer governs what that agent may pay. They sit on top of each other rather than competing, and the policy layer does not need to know which platform built the agent.
In practice that means giving each agent that can move money a per-agent spending limit that aggregates across a day, a week and a month, a merchant-locked virtual card so an agent authorized to renew one vendor cannot pay a different one, an approval threshold that holds a payment for a named person above an amount you choose, and an audit trail that records which agent paid whom, under which rule, in dollars. Those records are the evidence AI Control Tower's risk and compliance workflows can then consume.
The test for whether you need it is short. If your ServiceNow agents triage tickets, summarize incidents and draft knowledge articles, AI Control Tower plus the assists kill switch set to enforce is proportionate, and you can stop here. If any agent, on ServiceNow or anywhere AI Control Tower discovers, has a tool that creates orders, pays invoices or holds a card, you are governing identity and trusting the amount to a prompt. Pick a plan and put a ceiling on the first agent in minutes.
How ServiceNow compares with the other agent control planes
Six vendors, six published models, one pattern. We have measured the machine-readable models behind the major agent control planes shipped in 2026 using the same method each time. Microsoft Agent 365: 48 agent-governance types, 623 properties, zero money. Salesforce Agentforce: 178 money objects and 41 agent objects out of 1,757, with an intersection of zero. AWS AgentCore: one optional per-session USD amount on a session that lives at most eight hours, with no cumulative total. Gemini Enterprise: a real hard cap that refuses work, scoped to a billing project rather than an agent. The payment MCP servers: write access to live payment APIs with no ceiling at all.
ServiceNow is the sixth: 84 agent columns, zero money, a containment kill switch that fires on threats rather than amounts, and the only real money limit in the product attached to a human approver's job code. Every one of these organizations governs identity, access and capability, and every one declines to govern the amount a specific agent may commit to a specific counterparty. Oracle, measured since, is the seventh and the most careful of the group: its Oracle AI Agent Studio agent API carries 215 properties with no amount, but Fusion approvals and Budgetary Control still guard any spend that becomes an Oracle document. Workday is the eighth: its Workday Agent System of Record API has 101 agent properties and no money field, while business process approvals and budget checks cover only spend that becomes a Workday document. For the category as a whole, see AI agent governance and the vendor comparison of AI agent payment platforms.