High-risk tools in NowAIKit — ServiceNow AI Toolkit
34 of the 410 tools in NowAIKit — ServiceNow AI Toolkit are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
batch_requestExecuteExecute multiple ServiceNow REST API operations in a single HTTP call.
-
categorize_incidentExecuteSuggest category, assignment group, and priority for an incident by analysing similar resolved incidents (Table API). Predictive Intelligence has no public REST prediction endpo...
-
commit_changesetExecuteCommit an update set (requires SCRIPTING_ENABLED=true)
-
create_business_ruleExecuteCreate a new business rule (requires SCRIPTING_ENABLED=true). ServiceNow supports ES2021 async/await in scripts.
-
create_flow_actionExecuteCreate a custom Flow Designer action. **[Scripting]**
-
create_scheduled_jobExecuteCreate a new scheduled script execution job (requires WRITE_ENABLED=true)
-
execute_background_scriptExecuteExecute a background script on the instance (server-side JavaScript). **[Scripting]**
-
execute_playbookExecuteExecute a playbook step by step, passing results forward through context (requires NOW_ASSIST_ENABLED). Supports dry_run.
-
execute_scriptExecuteExecute a server-side script on the ServiceNow instance (Background Script).
-
fire_eventExecuteFire a custom ServiceNow event for a specific record (requires WRITE_ENABLED=true)
-
fluent_buildExecuteBuild a ServiceNow fluent/now-sdk project. Runs
-
fluent_explainExecuteRun
-
fluent_initExecuteInitialize a new ServiceNow fluent/now-sdk project. Runs
-
fluent_validateExecuteValidate a ServiceNow fluent/now-sdk project. Runs
-
ml_detect_anomaliesExecuteRun anomaly detection on operational metrics (alert volume, incident trends, etc.)
-
ml_train_anomaly_detectorExecuteTrigger training of an anomaly detection model for a specific table/field. **[Write]**
-
ml_train_change_riskExecuteTrigger training of the change risk prediction ML model. **[Write]**
-
ml_train_incident_classifierExecuteTrigger training of the incident classification ML solution. **[Write]**
-
publish_changesetExecutePublish/export an update set to XML for deployment (requires SCRIPTING_ENABLED=true)
-
run_aggregate_queryExecuteRun a grouped aggregate (COUNT, SUM, AVG) query on any table (latest release: /api/now/stats/{table})
-
run_atf_suiteExecuteExecute an ATF test suite (requires ATF_ENABLED=true)
-
run_atf_testExecuteExecute a single ATF test (requires ATF_ENABLED=true)
-
run_discovery_scanExecute[Write] Trigger a ServiceNow Discovery scan for network/infrastructure
-
run_security_playbookExecuteExecute a security response playbook against an incident. **[Write]**
-
run_transform_mapExecuteExecute a Transform Map on an Import Set to load data (requires WRITE_ENABLED=true)
-
scan_vulnerabilitiesExecuteTrigger a vulnerability scan for specified CIs or groups. **[Write]**
-
test_flowExecuteExecute a flow in test mode with sample inputs. **[Write]**
-
test_now_assist_skillExecuteInvoke a Now Assist skill with test input to verify behavior (requires NOW_ASSIST_ENABLED)
-
trigger_flowExecuteTrigger a Flow Designer flow with optional input parameters (requires WRITE_ENABLED=true)
-
trigger_scheduled_jobExecuteImmediately execute a scheduled job on-demand (requires WRITE_ENABLED=true)
-
update_business_ruleExecuteUpdate a business rule (requires SCRIPTING_ENABLED=true)
-
update_script_includeExecuteUpdate a script include (requires SCRIPTING_ENABLED=true)
-
update_ui_actionExecuteUpdate an existing UI Action (requires SCRIPTING_ENABLED=true)
-
visualize_trendExecuteBuild a real-time trend line of ServiceNow record counts over time (e.g. incidents opened per day). Returns chart-ready series, a Teams Adaptive Card line chart, a markdown tabl...
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.