## What Makes a Workflow "Agentic"?
A traditional ServiceNow workflow follows rules: if condition A, do action B. An agentic workflow makes decisions: given the current context and historical patterns, what's the best action, and am I confident enough to execute it autonomously?
The difference is the AI layer in the middle. Here are five patterns that make that distinction concrete.
## Pattern 1: Confidence-Gated Autonomous Resolution
The most important pattern. Never let an AI agent execute a remediation unless it exceeds a confidence threshold.
``
javascript
// Flow Designer — Subflow: Confidence Gate
const confidenceGate = {
input: { incident_id: "string", ai_recommendation: "object" },
steps: [
{
name: "Evaluate confidence",
type: "condition",
condition: "ai_recommendation.confidence_score >= 0.85",
if_true: "auto_execute",
if_false: "human_review_queue"
},
{
name: "auto_execute",
type: "action",
action: "Execute Remediation",
inputs: { runbook_id: "ai_recommendation.runbook_id" }
},
{
name: "human_review_queue",
type: "action",
action: "Create Task",
inputs: {
assignment_group: "AI-Assisted Ops",
work_notes: "AI confidence below threshold. Top recommendation: " +
"${ai_recommendation.description} (${ai_recommendation.confidence_score * 100}%)",
priority: "ai_recommendation.suggested_priority"
}
}
]
};
`
The 85% threshold is a starting point — calibrate it to your incident history. Most organizations land between 80-90% after 30 days of observation.
## Pattern 2: Dynamic Runbook Selection
Instead of hardcoding "if CPU high, restart service," train your agent to select from a catalog of runbooks based on incident signals.
javascript
// Integration with Databricks for runbook matching
const runbookMatcher = {
trigger: "incident.created AND category == 'infrastructure'",
action: {
type: "REST",
endpoint: "https://your-databricks-workspace/serving-endpoints/runbook-matcher/invocations",
body: {
dataframe_records: [{
incident_description: "${incident.short_description}",
affected_ci: "${incident.cmdb_ci.name}",
error_patterns: "${incident.description}",
historical_context: "${last_5_similar_incidents}"
}]
},
response_mapping: {
"runbook_id": "choices[0].message.content.runbook_id",
"confidence": "choices[0].message.content.confidence",
"reasoning": "choices[0].message.content.reasoning"
}
}
};
`
## Pattern 3: Cross-Platform Orchestration Chain
The most powerful pattern: ServiceNow as the execution orchestrator across multiple platforms.
Trigger: Datadog alert → ServiceNow incident
↓
[ServiceNow] Classify and route
↓
[Okta] Verify agent permissions for this incident category
↓
[Databricks] Run root cause analysis model
↓
[ServiceNow] Execute recommended remediation
↓
[Datadog] Verify recovery via health check
↓
[ServiceNow] Auto-close with AI-generated resolution note
Each step is a separate Flow Designer subflow, making the chain modular, testable, and observable.
## Pattern 4: Now Assist Skill for Contextual Summaries
Instead of engineers reading 50 comment threads to understand an incident, a custom Now Assist skill generates a structured briefing.
javascript
// Custom Now Assist Skill definition
const incidentBriefingSkill = {
skill_name: "Incident Intelligence Briefing",
trigger: "On demand / incident view load",
context_inputs: [
"incident.description",
"incident.work_notes",
"incident.related_incidents",
"incident.cmdb_ci.recent_changes"
],
prompt_template: You are an expert IT incident analyst. Review the following incident data and produce a structured briefing.
Incident: {incident.description}
Work Notes: {incident.work_notes}
Related: {incident.related_incidents}
Recent Changes: {incident.cmdb_ci.recent_changes}
Provide:
1. Root cause hypothesis (1 sentence)
2. Blast radius (which systems/users affected)
3. Top 3 remediation options, ranked by speed
4. Risk assessment if we do nothing for 1 hour
,
output_format: "structured_json",
display_in: "incident_form_header"
};
`
## Pattern 5: Predictive Escalation
Don't wait for an incident to breach SLA. Predict which in-flight incidents are at risk and escalate proactively.
javascript
// Scheduled flow: runs every 15 minutes
const predictiveEscalation = {
trigger: { type: "scheduled", interval: "15m" },
query: "active incidents WHERE sla_percentage > 60 AND priority IN ('P1','P2')",
for_each_incident: {
action: "Call ML Model",
model: "sla_breach_predictor",
inputs: {
current_sla_pct: "${incident.sla_percentage}",
assignee_workload: "${assignee.open_incident_count}",
incident_complexity_score: "${incident.complexity_score}",
time_of_day: "${current_hour}",
historical_breach_rate: "${assignee.sla_breach_rate_30d}"
},
on_breach_probability_gt_70: {
action: "Escalate Now",
notify: ["incident.assignment_group.manager", "incident.watch_list"],
message: "AI predicts SLA breach in ~{predicted_minutes_to_breach} minutes. Immediate attention required."
}
}
};
``## Building These Into Production
These five patterns aren't independent — they compose. The confidence gate wraps pattern 2 and 3. The Now Assist briefing (pattern 4) informs the human reviewer in the confidence gate's fallback path. Predictive escalation (pattern 5) triggers the cross-platform chain (pattern 3) for at-risk incidents.
Start with pattern 1 (confidence gating) and pattern 4 (AI summaries). These deliver immediate value with minimal risk — they enhance human decisions rather than replace them. Once your team trusts the AI layer, expand to full autonomous execution.