snow_create_devops_change

What snow_create_devops_change does on Serac

AI agents use snow_create_devops_change to create or update resources in Serac, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Serac environment.

Why snow_create_devops_change is rated Medium

The tool creates a new change request, which is a write operation (data creation). However, the severity is elevated to 'high' rather than 'medium' because change requests in ServiceNow DevOps pipelines can trigger downstream deployment automation. An AI agent misusing this tool could create unauthorized change requests that initiate unintended production deployments, affecting system availability and infrastructure.

From the tool's definition Tool name includes 'create' and description states 'Create automated DevOps change request for deployments' — this creates a new change request object in ServiceNow, a reversible write operation.

The rule that runs snow_create_devops_change safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Serac, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For snow_create_devops_change, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "snow_create_devops_change": {
      "limits": [
        {
          "counter": "snow_create_devops_change_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about snow_create_devops_change