CMDB foundations, Now Assist, AI agents, and governance — written from real enterprise engagements.
My ongoing series on what the AI transition actually looks like inside enterprise ServiceNow programs — written from live implementations, not vendor decks.
Every Now Assist skill and AI agent ultimately reads your platform data. If CIs are stale, relationships are missing, and CSDM is half-adopted, AI doesn't fail loudly — it answers confidently and wrongly. Before activating a single skill, score your CMDB on the three Cs: completeness, correctness, and compliance. That score, not your license tier, predicts your AI outcome.
The most common state I find in enterprise instances isn't 'no AI' — it's AI that was licensed, briefly piloted, and quietly abandoned. The root cause is almost never the technology. It's activation without adoption planning: no defined use case owner, no baseline metric, no governance. My rule: never activate a skill without naming who benefits and how you'll measure it.
The fastest way to lose trust in AI agents is to let them act unsupervised on day one. The pattern that works: agents draft, humans approve, and the approval rate becomes your promotion criterion. When an agent's suggestions are accepted 90%+ of the time for a sustained period, you've earned the right to automate that step fully.
Short, concrete answers to questions I get asked in nearly every engagement.
Documentation and blog posts routinely list plugin IDs that have been renamed or repackaged between releases. Before any customer submission or activation plan, open the instance's Plugins list and confirm every ID exists exactly as written. Five minutes of verification saves an embarrassing failed activation in a change window.
Many instances still run legacy Zing search in some portals while AI Search powers others. Users experience this as 'search is inconsistent,' and no amount of knowledge-article tuning fixes it. Audit every search-enabled experience, confirm which engine backs it, and migrate deliberately — AI Search configuration is also a prerequisite for several Now Assist experiences.
In every configuration guide I deliver, each numbered step contains exactly one action. Compound steps ('open the console and configure permissions and activate the skill') are where handoffs fail and rollbacks get missed. It feels pedantic until an admin at 2 a.m. is executing your runbook under pressure.
The data layer determines everything. These are the foundations I put in place before any AI conversation.
Completeness (are the CIs and relationships there?), correctness (are attributes accurate and current?), and compliance (do records follow your data policies?). Score each per CI class, weight by business criticality, and you have a defensible readiness number for executives — and a prioritized remediation backlog for the platform team.
Full CSDM adoption as a single program stalls. What works: pick one business application family, model it end to end — Business App → Application Service → infrastructure — prove the reporting value, then template the pattern. Each slice takes weeks, not quarters, and builds the organizational muscle.
Identification and Reconciliation Engine rules decide whether integrations enrich your CMDB or pollute it. Every new data source gets a reconciliation review: which attributes it owns, its precedence versus Discovery, and what happens on conflict. Skipping this is how duplicate CIs and attribute flapping are born.
HR is one of the highest-value early homes for Now Assist — high case volume, repeatable inquiries, and measurable employee experience.
Case summarization for HR agents, knowledge generation from resolved cases, and employee-facing answers through the portal. These three cover the bulk of early value: agents ramp faster on transferred cases, the knowledge base stops decaying, and tier-1 inquiry deflection rises — all measurable within the first quarter.
ServiceNow's AI-native HRSD packaging tiers map to capability depth: start by listing the ten HR workflows you actually want AI to touch, then find the lowest tier that covers them. Buying Prime to 'future-proof' while running Foundation use cases is the most common overspend I see.
Leave-of-absence, accommodations, ER cases: AI can summarize and route, but response drafting stays human-approved. Configure skill availability per HR service, not globally — the admin console supports this granularity, and your employment counsel will thank you.
Once AI assets multiply, leadership needs one place to see usage, value, and risk. That place is AI Control Tower.
The right moment to stand up AI Control Tower is when you activate your second AI use case — not when audit asks who approved the first ten. Inventory every skill and agent, assign an owner to each, and define what 'healthy adoption' looks like. Retro-fitting governance onto sprawling AI is ten times the work.
Which AI is running, is anyone using it, and is it worth what we pay? Control Tower answers all three if you configure value tracking from day one: activation status, usage trends per skill, and adoption against the baseline you captured before go-live. No baseline, no value story.
For regulated industries, map each AI asset to the controls it touches: data access scope, human-review points, and fallback behavior. Documented in Control Tower, this converts 'we use AI responsibly' from a claim into evidence.
Agents are where AI stops suggesting and starts doing. The design patterns below are how they get there safely.
Every production agent I deploy has explicit boundaries: which tables it may write, which fields it may never touch, and a hard cap on actions per run. Constrained agents ship to production; unconstrained ones live forever in sub-production while risk teams debate them.
'CMDB Data Manager' isn't valuable because it runs — it's valuable because stale CI count drops and audit findings close. Define the outcome metric before building the agent, wire the measurement into the workflow, and review it in your governance cadence. Agents without metrics become shelfware with extra steps.
Start every agent in suggest mode. Move to approval-gated action once accuracy is proven. Grant full autonomy only for the specific, bounded scenarios where the approval step has become a rubber stamp. This ladder is how you scale agents without a single trust-destroying incident.