SoftTech AI Registry
ServiceNow · IT Service Management

Triage and Categorize ITSM Incidents Agentic Workflow

A ServiceNow agentic workflow in IT Service Management that runs a team of three AI agents to autonomously set an incident's category and subcategory, assign service, service offering and configuration item, and link the incident to a related major incident or problem. Documented for the Australia release.

Recorded characteristics

Function
ServiceNow documents this as an AI agent team, not a single agent. Executed in order: the Categorize ITSM incident AI agent assigns Category and Subcategory from the incident short description and updates Work notes; the Classify service and CI AI agent assigns Service, Service offering and Configuration item and updates Additional comments and Work notes; the Link major incident or problem AI agent links the most similar major incident and ends the workflow, or, if none is found, links a matching ongoing problem, updating the parent incident or problem field and Additional comments. Triggering is automatic when State is New or updated to In progress, Assigned to is empty and Priority is 3, 4 or 5; triggering is manual when State is In progress and Assigned to is not empty. Documentation states all executions are autonomous and the workflow does not require user input during execution.
Data access
Reads the incident record, principally the short description and context, and searches services, service offerings, configuration items, major incidents and problems. Linking to related problems relies on semantic indexing of the Problem table when the workflow is duplicated. Writes are limited to the documented incident fields: Category, Subcategory, Service, Service offering, Configuration item, parent incident or problem, Work notes and Additional comments. No documented setting of assignment group, assignee, priority or incident state by this workflow.
Actions
Can take actions
External actions
Unknown
Human confirmation
Not required
Permission basis
Dedicated agent identity
Administrative control
Configured in AI Agent Studio under Create and manage. Administrators control the trigger Active flag, the trigger user (a user with the itil role), each AI agent's Status on the Define availability screen, the Run as entity, and role-based access on the Select display screen where the itil role is added by default. Linking to major incidents requires activating the Incident Management - Major Incident Management plugin (com.snc.incident.mim). The workflow can be duplicated and modified.
Default state
Conditional
Availability
Documented for the Australia release (page updated 12 March 2026) and also present in Zurich documentation. Requires installation of the ServiceNow Otto for IT Service Management (ITSM) (sn_itsm_gen_ai) plugin and the Incident Management application. The workflow ships with the ITSM agentic AI application but must be activated by turning on the trigger and enabling each AI agent's status.
Licensing
Not established from ServiceNow documentation reviewed. No SKU or edition requirement is stated on the pages cited.
External model or provider
Not established. No model or model provider is named in the ServiceNow documentation for this workflow.
Limitations and uncertainty
Boundary: this record covers only the Triage and categorize ITSM incidents agentic workflow. The Investigate and resolve ITSM incidents workflow, the Wrap-up and resolve incident workflow, Incident assist, Generate post incident reviews and Major Incident Management capabilities are separate and are not covered here. Identity: established - ServiceNow documents that the ITSM Worker AI Agent user record is of identity type AI agent and is available by default, and the workflow configuration sets Run as = AI user with the desired AI agent user selected. Authorization scope: configuration-dependent - customers can create AI users of identity type AI agent, assign roles to them, and those assigned roles determine the data access available to the workflow; the exact roles and privileges assigned in a particular customer environment are not established. Trigger configuration: activating the trigger requires entering the sys_id of a user with the itil role, but current documentation does not establish that this trigger identity is a second runtime authority for the AI agents' operational writes. Human confirmation: not required for the documented autonomous categorization, incident field updates and major-incident/problem linking; no per-action approval gate is documented for those operations. This does not mean no human is involved in configuration, activation, monitoring or later incident handling. Not established: outbound actions to external systems; model or provider; licensing SKU; and whether a formal preview or general-availability designation applies.

Evidence

Separate paid assessment · Operational Clarity

AI Authority Assessment for your software context

What could this AI decide or do in the software your organisation uses — and where would permissions or human approval matter?

This free Registry record describes documented capabilities and evidence limits. Operational Clarity’s AI Authority Assessment is a separate, paid, organisation-specific analysis with an agreed scope, examining documented capabilities, action permissions, external actions and human approval requirements.

Documentary analysis does not establish your actual configuration. It is not certification, vendor endorsement or ongoing monitoring. Commissioned work does not influence Registry admission or published findings; public records remain free.

Enquire about an AI Authority Assessment