ServiceNow announced a new system called the Enterprise Identity Control Plane after buying a company named Veza. Veza focuses on identity governance, which means keeping track of who or what has permission to use certain systems and making sure those permissions are correct. By adding Veza’s technology into its platform, ServiceNow wants to manage access from one main location instead of using many separate tools that may not communicate well with each other.
In many companies, identity systems were built over time. Different teams added different tools as new software was introduced. As a result, access control often became scattered across several platforms. One system might manage employee logins, another might control cloud permissions, and another might handle service accounts. Bringing Veza into the ServiceNow platform is meant to reduce that complexity and create a clearer, more unified way to see who or what has access across the organization.
Today, companies deal with many different kinds of identities. These include employees, contractors, service accounts, API keys, automated scripts, and AI systems that can act on their own. Each of these identities may have different levels of access, and those levels can change over time. In many businesses, these identities are managed by different programs that do not always connect well. This makes it harder to see who has access to what, harder to remove access when it is no longer needed, and more difficult to investigate problems when mistakes happen.
As AI systems start doing more tasks, such as pulling data, updating records, approving requests, or setting up cloud resources automatically, access control becomes even more important. AI tools may be given permissions to move quickly and respond in real time. If identity systems are scattered or poorly tracked, the risk of errors or security issues grows. A small configuration mistake could allow an AI system to access sensitive data or take actions beyond what was originally intended.
Regulators are also watching companies more closely to make sure they protect their systems and limit access to only what is necessary. Many cybersecurity frameworks now require clear records of who has access and why. Company leaders and board members want straightforward answers about which people or machines can take important actions and how those permissions are reviewed. This move by ServiceNow mainly strengthens the Security and Risk side of AI governance because it focuses on controlling access and limiting exposure, rather than tracking model performance or managing the full AI lifecycle.
Identity Is Where Most Breaches Begin, And its Where Autonomous Security has to Start
AI Growth and Identity Sprawl Increase Pressure for Centralized Access Control
The Enterprise Identity Control Plane was created in response to growing challenges around identity management, especially as organizations expand their use of AI and cloud services.
AI systems need permission to access data and perform tasks across many different software tools and cloud platforms.
Machine identities, like API tokens and service accounts, often outnumber human users in large companies, increasing complexity.
Security breaches caused by misuse of access rights have raised concern among executives, security teams, and board members.
Regulators expect companies to prove they control access carefully and limit permissions to what is truly needed for each role.
The rise of cloud software and third-party integrations has spread identity management across many disconnected systems.
Many organizations cannot easily see which identities are allowed to take high-risk or irreversible actions.
These pressures make identity control more urgent than it was in the past. As AI systems gain more power to act on their own, weak or disconnected identity systems can lead to serious problems, including data leaks, system outages, or compliance failures. Bringing identity enforcement into one central system helps companies reduce risk, improve visibility, and respond more quickly when something goes wrong.
Centralized Identity Control Changes How AI Access Is Approved and Tracked
The benefits of a centralized identity system become clear when an AI tool tries to perform an important action inside a live environment. For example, imagine an AI system that automatically adds cloud resources when website traffic increases or that updates customer records after analyzing new data. In a scattered setup, its permissions might be checked in one system while other approvals happen somewhere else. This can create gaps, delays, or inconsistent decisions about whether the action should be allowed.
With a centralized control plane, the AI system’s credentials are checked against one clear and consistent set of rules before it takes action. Approval limits, temporary permissions, and escalation steps are handled in a coordinated way. If an action is considered high risk, the system can require additional approval or block it automatically. The key change is that access decisions now happen in one main system instead of across several disconnected tools that may apply different standards.
Logging also becomes more detailed and easier to review. The system records which identity took an action, what permissions it had at that moment, and which rule allowed the action to move forward. If something needs to be reversed or investigated later, that information is stored and organized in one place. This helps companies understand what happened, when it happened, and why the system allowed it.
Some things do not change. Companies still decide who gets access, how much access they have, and when permissions must be reviewed or removed. The platform enforces those decisions and makes them easier to track, but the company is still responsible for setting the rules, monitoring compliance, and following the law.
Centralized Enforcement Improves Visibility While Companies Keep Responsibility
The new identity control system brings access checks into one main platform. This reduces confusion about where permissions are reviewed and enforced. ServiceNow collects and evaluates identity information in one place, which makes it easier to trace how access decisions are made across different departments and systems.
Even so, companies still create their own policies. They decide which users or AI systems can have certain privileges, how long those privileges last, and when special approval is required for sensitive actions. The platform applies these rules consistently, but it does not choose them. Organizational leadership remains responsible for defining acceptable risk levels.
If access rules are set up incorrectly and lead to a security breach or misuse of data, the company remains responsible. The system can centralize enforcement and improve tracking, but it does not remove legal or regulatory responsibility from the organization. Accountability for protecting data and systems still belongs to the enterprise.
Some challenges still exist even with centralization. Different cloud systems may follow different access standards that are not fully aligned. Short-term machine credentials can be created and expire quickly, making them harder to monitor. AI tools added without proper approval may not be fully visible inside official systems. Over time, extra permissions may build up and not be removed, which weakens security and increases risk if not reviewed regularly.
Our Take
AI Governance Take
This announcement makes one thing clear: identity control is no longer a background IT task. It is becoming one of the main ways companies control AI systems that can act on their own. When an AI tool can retrieve data, change records, or trigger workflows, the first and most important question is whether it has the right permissions. Identity enforcement is the checkpoint that decides if an action moves forward or stops before damage happens.
Across the industry, companies are moving away from scattered access tools and toward platforms that combine visibility, control, and enforcement in one place. As AI systems take on more responsibility and operate faster than humans can review each step, identity governance becomes directly tied to AI governance. If access rules are weak or unclear, AI systems can act beyond what leaders intended. Strong identity control keeps automated systems inside clear boundaries and reduces the chance of serious mistakes.
This update strengthens the Security and Risk side of AI governance in a practical way. It does not measure model accuracy or create regulatory reports. Instead, it controls who or what is allowed to act inside company systems. When machines operate at scale and make rapid decisions, identity governance defines the real limits of their authority and becomes the guardrail that protects the organization.
