snow_request_approval

What snow_request_approval does on Serac

AI agents use snow_request_approval to create or update resources in Serac, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Serac environment.

Why snow_request_approval is rated Medium

Creating approval records is a reversible write operation (the record can be modified or deleted). However, it escalates to 'high' severity because it engages workflow authorization infrastructure in an enterprise system—an AI agent could create fraudulent approval requests, bypass normal change control, or request unwarranted approvals at scale, with significant business impact even though the action itself is not…

From the tool's definition Tool description states it "Create[s] a sysapproval_approver record", which is an explicit write operation that creates new data in the ServiceNow system. The incomplete description cuts off mid-sentence at "Sets state to", but the creation action is clear.

The rule that runs snow_request_approval safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Serac, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For snow_request_approval, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "snow_request_approval": {
      "limits": [
        {
          "counter": "snow_request_approval_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about snow_request_approval