Unified tool for ServiceNow HR Lifecycle Events (LEM): manage lifecycle-event cases (sn_hr_le_case), their activities (sn_hr_le_activity), and the journey templates that drive them (sn_hr_core_journey_template, sn_hr_core_journey_activity). Actions: - create_event — open a new lifecycle-event cas...
AI agents use snow_hr_lifecycle_event to create or update resources in Serac — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Serac environment.
This tool creates and modifies HR lifecycle event cases (onboarding, offboarding, transfer, role change) in ServiceNow. Creating or completing such cases has significant HR consequences for employees — triggering or halting onboarding/offboarding workflows, access provisioning, and payroll changes. The primary actions are Write (create/modify records), though the downstream effects are high-severity.
From the tool's definition create_event — open a new lifecycle-event case for an employee (onboarding, offboarding, transfer, role change); complete_event — mark a lifecycle-event case as complete (closes the case and stops scheduled acti
Attacks that exploit this kind of access
Unified tool for ServiceNow HR Lifecycle Events (LEM): manage lifecycle-event cases (sn_hr_le_case), their activities (sn_hr_le_activity), and the journey templates that drive them (sn_hr_core_journey_template, sn_hr_core_journey_activity). Actions: - create_event — open a new lifecycle-event case for an employee (onboarding, offboarding, transfer, role change). Optionally seeds activities from a journey template. - list_events — list lifecycle-event cases, filtered by employee, type, or state - complete_event — mark a lifecycle-event case as complete (closes the case and stops scheduled activities) - list_pending_for_employee — return open lifecycle-event activities assigned to an employee or owned by their case - trigger_journey — instantiate the activities defined on a journey template against an existing lifecycle-event case Use when: the agent needs to drive an end-to-end employee lifecycle event in HRSD. For a single ad-hoc HR ticket use snow_create_hr_case; for offboarding-only flows snow_employee_offboarding is a thinner wrapper around sn_hr_core_case. Requires the HR Lifecycle Events plugin (com.sn_hr_lifecycle_events). Tables may be absent on instances without the plugin, in which case the tool fails with a clear plugin-missing error. It is categorised as a Write tool in the Serac MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.
Register the Serac MCP server in PolicyLayer and add a rule for snow_hr_lifecycle_event: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Serac. Nothing to install.
snow_hr_lifecycle_event is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.
Yes. Add a rate_limit block to the snow_hr_lifecycle_event rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for snow_hr_lifecycle_event. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
snow_hr_lifecycle_event is provided by the Serac MCP server (serac-labs/serac). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
snow_hr_lifecycle_event is one line of Serac's registry record.
The record carries the whole server: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.
Teams ship this data inside their own products. See what a licence covers →