From the ServiceNow edition of November 4, 2026
A few AI agent updates in the ServiceNow Brazil release
ServiceNow (Community article by ServiceNow employee) · Enterprise platform; applies to all ServiceNow customers including public sector · Global
- Publisher
- ServiceNow Community (CEG AI CoE articles)
- Original publication
- 2026-11-03 (posted 'yesterday' relative to 2026-11-04 retrieval)
- Source retrieved
- 2026-11-05
What happened
Brazil release notes add MCP server security controls (access rules, allowed tools), an Access Analyzer test for AI agent/workflow access, a redesigned AI Agent Studio with built-in automated evaluations, and deny-by-default access control for specified agentic AI record types on newly activated instances (previously allow).
Why it matters
Directly relevant to agencies and universities building Now Assist AI agents: deny-by-default and MCP tool allow-lists support least-privilege controls auditors expect. Note the default change applies to newly activated instances; existing instances may retain prior allow defaults.
Evidence and measured results
Short vendor-employee summary of release notes; no testing or independent validation. Availability depends on instance version and plugins.
Limitations and uncertainty
Secondary vendor summary; full release notes not inspected here; default change limited to newly activated instances.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-05; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Public-sector ServiceNow customers lack confidence that AI agents and MCP tools are limited to least-privilege access.
- Stakeholders
- CISO
- ServiceNow platform owner
- Internal audit
- AI governance board
- Discovery questions
- How many AI agents and MCP servers are active?
- Are your instances newly activated or upgraded?
- When is your Brazil upgrade planned?
- Who approves agent access today?
- Value hypothesis
- Applying Brazil controls may reduce over-permissioned agent risk and ease audit evidence collection.
- Potential engagement
- A bounded AI agent access review and hardening plan tied to the Brazil upgrade.
- Unsupported claims
- Controls are independently validated
- Deny-by-default applies to existing upgraded instances
- These controls mitigate recent AI Platform CVEs
Pre-sales engineering
Role takeaway
- Fit
- Fits ServiceNow customers using AI Agent Studio or MCP servers who can upgrade to Brazil.
- Architecture and integration
- Configure MCP server access rules and allowed tools; ACLs on agentic AI record types; Access Analyzer tests.
- Prerequisites
- Brazil release upgrade
- Relevant plugins activated
- Agent and MCP inventory
- Constraints
- Deny-by-default only on newly activated instances
- Feature availability varies by version and plugins
- Security
- Enforce least privilege for agents and MCP tools; audit access with Access Analyzer.
- Proof of value
- Access Analyzer denies access for unauthorized test users
- Each MCP server exposes only allow-listed tools
- Compare pre/post ACL defaults on upgraded instance
Delivery
Role takeaway
- Work
- Inventory agents and MCP servers, set deny-by-default ACLs and tool allow-lists, test access.
- Dependencies
- Brazil upgrade
- Security team review
- Agent owners
- Ownership
- ServiceNow platform team with CISO sign-off.
- Skills and adoption
- Admins trained on AI Agent Studio redesign, ACLs and MCP controls.
- Governance checkpoints
- Security review of each agent's access
- Change approval for ACL changes
- Periodic access recertification
- Acceptance criteria
- Proposed: 100% of agents have reviewed explicit ACLs
- Proposed: no MCP server with unrestricted tools
- Risks
- Breaking existing agent workflows
- Assuming defaults changed on upgraded instances
- Incomplete agent inventory
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
MCP servers attached to agents now have tool allow-lists; agent teams must design explicit access grants under deny-by-default.
Governance
Who approves, reviews and stays accountable for outcomes?
Supports least-privilege AI agent governance; agencies should verify whether upgraded (not newly activated) instances keep allow defaults and remediate.
Security and privacy
What data, permissions and controls need testing?
Reduces risk of over-permissioned agents and unvetted MCP tools; Access Analyzer helps audit access. Does not address recent platform CVEs.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Platform admins need skills in agent access modeling and MCP configuration.
Procurement
What should contracts, pricing and exit terms secure?
No direct licensing change stated; upgrade planning may be needed to reach Brazil release.
Operating model
Which teams own the service once it runs?
Platform teams take on access review for each agent and MCP tool as a standing control.
Publication history
- 2026-11-04ServiceNow · Issue 053 resources
Stable resource ID: servicenow-brazil-release-ai-agent-deny-by-default-mcp-controls