ServiceNow Executive Names Four Guardrails for Agents

The bottleneck is not the model — it is everything around it. In an opinion piece for SiliconANGLE, Amit Zavery, president, chief product officer and COO of ServiceNow, argues that enterprise AI agents come apart because four surrounding capabilities are missing: sense, decide, act and secure. In each of his examples, he writes, the agent did what it was built to do; what failed was the scaffolding around it.

The four incidents behind the argument

Zavery opens with four cases. A coding agent at PocketOS deleted an entire production database. An internal agent at Meta left sensitive user data exposed for two hours. An Instagram support chatbot was hijacked by attackers, compromising thousands of accounts, and at GitHub a prompt injection led an agent to leak data from a private repository.

The piece supplies no dates for these events, no statements from the companies involved, and no figures beyond thousands of accounts. This single article was the only source available to us, so the incidents should be read as the author's account rather than as independently confirmed fact.

Sense: working from stale facts

The first gap is the data layer. When a policy changes or a system status shifts and that change does not reach the agent in time, every downstream decision rests on an outdated picture. Zavery's prescription is to connect distributed sources across departments and systems, and to treat data as a continuous signal rather than a periodic snapshot.

Decide: judgment without memory

Current data describes the present state, not the history behind it. What agents lack, he argues, is access to decision precedents: how comparable requests were resolved before, and how those resolutions turned out. Applying that to the Meta case, he points to flawed technical guidance and suggests better historical grounding might have prevented the exposure. That is the author's reading, not a demonstrated causal chain.

Act: from one agent to a workflow

A single agent stays manageable. Chain several into a workflow and context has to travel between steps, policies have to apply consistently, and control has to survive the systems underneath changing over time. That, in his account, is where agents drift outside their intended boundaries.

Secure: identity, permissions, kill switch

The fourth item treats agents the way an organization treats employees: their own identity, permissions scoped to the specific task, and an end-to-end audit trail. Zavery adds a requirement for a kill switch that revokes access the moment something looks anomalous. Without that layer, an autonomous tool is an account nobody supervises.

What the piece does not establish

This is a contributed column rather than reported work, and its author runs the product organization at ServiceNow — the same category of platform software the argument calls for. That context does not invalidate the analysis, but it frames it. The article offers no measured figures on how common such failures are, what they cost, or how widely agents are deployed, and no second independent newsroom was available to us to corroborate the four cases.