list_audit_results

What list_audit_results does on NowAIKit — ServiceNow AI Toolkit

AI agents call list_audit_results to retrieve information from NowAIKit — ServiceNow AI Toolkit without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why list_audit_results is rated Low

This tool retrieves and queries audit data without creating, modifying, or deleting records. However, audit results may contain sensitive information about system changes, user activities, or compliance violations, which could be valuable to an attacker for reconnaissance or privilege escalation planning. This elevates severity to medium despite the read-only nature.

From the tool's definition Tool name 'list_audit_results' and description 'List audit results and findings' both indicate data retrieval with no modification. The verb 'list' is a classic Read operation.

The rule that runs list_audit_results safely

PolicyLayer is an MCP gateway: it sits between your AI agents and NowAIKit — ServiceNow AI Toolkit, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For list_audit_results, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "list_audit_results": {}
  }
}

Questions about list_audit_results