01 / Principal and identity
Who acts, and what can the platform identify?
An operations agent acts from a current incident assignment.
ServiceNow user/role context and incident state identify the workflow actor.
- 01Originating task
- 02Agent or workload
- 03It closes an incident or triggers a remediation workflow.
- 04Observed effect
02 / Action-time control
Where can an unauthorized effect be stopped?
Check incident, affected CI, action class and current assignment at the workflow or protected API.
A diagnostic grant need not allow production remediation.
Delegation constraint
A child diagnostic agent cannot inherit the parent responder’s closure permission.
03 / Worked denial
Test a request outside the grant.
An agent investigating a database alert tries to restart an unrelated production service.
Adversarial verification
Reassign an incident immediately before an agent-triggered remediation. The workflow must use the current assignment and deny an action on a configuration item outside the case.
04 / Review and responsibility
What should the audit trail prove?
Incident/CI IDs, assignment version, action request, decision, workflow execution and service state.
Workflow automation and role checks remain separate controls.
Platform primary source