Knowledge 26: ServiceNow Wants to Be “the Rules and Rails of Business.”

Bill McDermott named the gap that has held enterprise AI back.

The single most useful sentence said at Knowledge 26 last week in Las Vegas came from Jon Sigler, who runs ServiceNow’s AI Platform: “There’s a major gap between adoption and accountability.”1 The gap he named is the one every CIO has been navigating in private for the better part of two years.

Bill McDermott put a number on it from the keynote stage: six out of ten companies are using agentic AI, but only one out of ten have built anything autonomous.2 Six in ten experimenting; one in ten in production. The gap is real, structural, and it has held enterprise AI in pilot purgatory.

ServiceNow’s argument at Knowledge 26 was that the gap closes with architecture, not exhortation. McDermott’s framing is unusually direct for vendor rhetoric: “We’ve built the only platform that can sense across the enterprise, decide the right action, act across any workflow or application, and secure every step. We are the rules and rails of business.”3He put it more pointedly during the keynote itself: “Governance isn’t a feature. It’s the whole ball game because without it your whole company can come down.”

That is the K26 thesis. It deserves more than a product-update read.

What ServiceNow actually built

Start with the AI Control Tower, because the rest of the K26 architecture orbits around it. ServiceNow expanded the Control Tower across five dimensions — Discover, Observe, Govern, Secure, Measure — and each is concrete enough to evaluate.

Discover reaches across the enterprise: thirty new integrations spanning AWS, Google Cloud, Azure, SAP, Oracle, Workday, plus non-human identities and connected devices including OT and IoT.

Observe replaces periodic audits with continuous runtime monitoring of what AI agents are actually doing — including how they reason and where they make decisions; the underlying capability comes from the Traceloop acquisition.4

Govern ships with five risk frameworks aligned to NIST and the EU AI Act.

Secure brings in identity governance via Veza — patented access graph technology that maps over thirty billion fine-grained permissions across human, machine, and AI agent identities, with scoped permissions and least-privilege enforcement.

Measure addresses the runaway-model-spend problem: cost tracking and ROI dashboards so finance leaders can answer questions about token bills before they compound.

The kill-switch capability is the most concrete control surface. From ServiceNow’s primary release: “When an agent goes off script or operates beyond its permissions, AI Control Tower can detect it and shut it down in real time — giving organisations the kill switch they need as agents take on more critical work.” At Knowledge 26 ServiceNow demonstrated this against a live prompt-injection attack on a pricing agent — the platform identified the malicious instructions, mapped the blast radius via Veza’s access graph, and presented a kill switch to disable the compromised agent without human intervention.

This is a more complete answer than the market had six months ago. It is also the cleanest articulation yet of what governance for agentic AI actually means as enterprise software, not as a deck.

What the customers actually say

The strongest evidence that the architecture matches the rhetoric came from customer voices on stage at Knowledge 26 — and what they each said tells you something different about the gap.

Booking.com framed AI Control Tower as visibility-into-decisions: “We’ve got AI as part of the decision-making process. The AI Control Tower gives us that AI inventory which will only help us evolve and identify the real use cases that bring real value.”5 AI inventory — the simplest possible articulation of what the Discover and Measure dimensions are for.

HDFC Bank went further. Ramesh Lakshminarayanan, the bank’s Group CIO: “As India’s largest private sector bank, we operate at a scale where AI governance isn’t optional, it’s foundational. We run ServiceNow AI across IT and risk, and AI Control Tower is the common governance layer across all of it, giving us the visibility to manage every AI use case and the confidence to scale.” Foundational, not optional — the line that separates serious deployment from serious experimentation.

FedEx framed it as identity-and-access: “We are building an AI control tower to make sure that we responsibly introduce this capability inside our environment. We know who those agents are. We can control the access and the rights for those agents.”6 Different industry, different scale, same sentence underneath.

Three customers, three different facets of the same architecture: AI inventory, governance-at-scale, agent identity. None of them sound like marketing material, because they are not. They are the words of operators who have already done the work to make the platform credible.

Where the platform meets its limit

The AI Control Tower governs agents at platform level. It manages permissions, surfaces drift, and observes what agents are doing on the Now Platform and the systems it integrates with. What it cannot reach is the data those agents act on before the platform ever sees them.

A ServiceNow consultancy commentary published during Knowledge 26 made the structural point directly: AI enforcement planes — sophisticated as they are — do not extend to the pre-processing data layer that feeds the models.7 The author has a commercial stake in the data layer he names, and we note it. The argument stands on its merits.

Vishal Talwar, FedEx’s CDIO, made the same point from the ServiceNow keynote stage — and made it as something FedEx itself owns rather than something the platform is supposed to deliver: “AI is only as good as the data that feeds it. That’s why we’ve been obsessed about building a strong data foundation.” He was speaking from a Fortune-50 customer panel, with the ServiceNow CEO standing three feet away. The data foundation is the customer’s job; the platform’s job starts where the foundation is sound.

This is not a gap ServiceNow can close for you. The data governance problem is organisational in nature. ServiceNow’s Context Engine grounds agent decisions in enterprise-specific context, but that grounding is only as good as what feeds it. Service Graph data, configuration records, asset relationships, approval chains — when those are clean, current, and governed, the platform is exactly as powerful as it promises to be. When they are not, it amplifies the noise.

This is a pattern we see consistently in our work with enterprises. The organisations getting the most from their platforms are not the ones with the newest capabilities switched on — they are the ones whose data models hold together under pressure. That was true before agentic AI. It is more consequential now.

Looking ahead

Three things stand out when you read Knowledge 26 not as a product catalogue but as a strategic signal.

The first is that the architecture for governed agentic AI is now real enterprise software. AI Control Tower’s expanded form ships through August 2026. Most platform vendors have not built further into the governance stack. ServiceNow now has.

The second is that the gap between adoption and accountability is the platform’s claim to close — and it is closing for organisations whose foundations are already in place. The Booking.coms, HDFC Banks, and FedExes did not arrive at Knowledge 26 ready to govern agentic AI by accident. They arrived ready because they had already done the unglamorous work.

The third is that this work has not gone away. The platform reaches further than it did six months ago, and it still cannot reach the source data. The leaders whose data models, service ownership, and configuration discipline hold together can cross the gap that Knowledge 26 named. The leaders whose foundations are still in progress have a sharper reason to close them — because the platform is now ready before they are, and that gap is now visible in a way it was not before.

The architecture has arrived. The foundation underneath is the same work it has always been — and it matters more now than it ever has.

By Kristina Petrić and Michel Conter

At Conter.biz, we work with enterprise leaders on the architecture, service-management, and data-governance foundations that determine how much value platform capabilities like these can deliver.

Sources

  1. ServiceNow Newsroom, “ServiceNow expands AI Control Tower to discover, observe, govern, secure, and measure AI deployed across any system in the enterprise,” 2026-05-05. https://newsroom.servicenow.com/press-releases/details/2026/ServiceNow-expands-AI-Control-Tower-to-discover-observe-govern-secure-and-measure-AI-deployed-across-any-system-in-the-enterprise/default.aspx ↩︎
  2. ServiceNow, “Welcome to Agentic Business — Knowledge 2026 opening keynote,” 2026-05-05 (Bill McDermott, Vishal Talwar of FedEx, et al.). https://www.youtube.com/watch?v=jeo2V1w-Peg ↩︎
  3. ServiceNow Newsroom, “ServiceNow turns enterprise AI chaos into control with the platform for governed, autonomous work,” 2026-05-05. https://newsroom.servicenow.com/press-releases/details/2026/ServiceNow-turns-enterprise-AI-chaos-into-control-with-the-platform-for-governed-autonomous-work/default.aspx ↩︎
  4. The Register (O’Ryan Johnson), “ServiceNow clears agents for landing with new AI control tower,” 2026-05-05. https://www.theregister.com/2026/05/05/servicenow_clears_agents_for_landing/ ↩︎
  5. ServiceNow customer showcase, “Booking.com’s AI agents get it right 97% of the time,” Knowledge 2026. https://www.youtube.com/watch?v=_n3rJIHjyx0 ↩︎
  6. ServiceNow customer showcase, “For FedEx, 5M ServiceNow workflows a month helps get work done,” Knowledge 2026. https://www.youtube.com/watch?v=ygjRvUFQmvs ↩︎
  7. sncdevelopment.com (EcoStratus Technologies), “Your AI Controls Don’t Govern the Data That Feeds Them,” 2026-05-04. https://sncdevelopment.com/2026/05/04/your-ai-controls-dont-govern-the-data-that-feeds-them/. The author has a commercial stake in StrataLayer; the structural argument is cited on its merits. ↩︎

Related Posts