Every enterprise we talk to has an AI mandate. Very few have an AI plan that survives contact with their CMDB. Here is the order of work we use in the first 90 days, learned on real platforms rather than demo instances.
Start with the work, not the model
ServiceNow Otto (the assistant formerly called Otto), AI Agents and the AI Control Tower are mature enough that the model is rarely the constraint. The constraint is choosing a workflow where an agent can finish a task, not just suggest one. Incident triage, access requests, change risk assessment and knowledge drafting all qualify because they have a clear owner, a clear end state and data the platform already holds.
Pick two. Write down what “done” means for each. Agree who approves the agent’s actions before anything is built. That last conversation takes an afternoon and saves a quarter.
Fix the data the agent will read
An agent that classifies incidents from the CMDB is only as good as the CMDB. Before switching anything on we run a two-week health assessment: completeness, correctness and compliance of the classes the use case depends on, plus the knowledge articles Otto will summarise.
The remediation list is usually short and specific. Duplicate CIs, stale relationships and unowned services are the three findings we see most, and all three are fixable in weeks with Service Graph Connectors and a few data policies. What you cannot do is skip this step and hope the model compensates. It will classify confidently and wrongly.
This is the shape of what a six-week remediation does to the three CMDB Health scores for the classes an incident agent depends on. The point is not the exact numbers, it is that correctness and compliance start low almost everywhere, and both are fixable.
Govern from the first agent, not the tenth
The AI Control Tower exists so you can see every model, agent and skill in one place, with cost, policy and audit attached. Since July 2026 it is included in every tier of the new commercial model (Foundation, Advanced and Prime), although older contracts should check their entitlement, and it now covers agents running on AWS, Azure, Google Cloud, SAP and Workday as well as ServiceNow’s own. There is no licensing reason left to postpone it.
Set it up before the first agent goes live. It is far easier to add agents to a governed estate than to retrofit governance onto a dozen agents that different teams switched on. Define the policies that matter to you (data residency, human approval for destructive actions, spending limits) and let the platform enforce them.
The register we aim for by the end of week one looks like this: everything discovered, an owner against each item, the policies that matter attached, and spend visible against plan.
Keep humans in the loop where it counts
Our pattern is simple. Agents classify, enrich, propose and route. People approve anything that changes production, money or access. Over time the approval step moves later as confidence grows, and the audit trail from the Control Tower is what justifies the move.
Teams that start fully automatic usually end up switching the agent off after the first surprise. Teams that start with approvals end up removing them one by one, with evidence.
Measure one number per use case
Resolution time for triage. Days to fulfil for access. Hours saved for knowledge. One number, measured before and after, reported monthly. That is what turns a pilot into a programme, and it is what the ASCEND assessment is built to give you in the first two weeks.
If you want the checklist we use, it is on our agentic AI services page, and the readiness assessment is where most of our AI engagements begin.
