SoftTech AI Registry
ServiceNow · IT Service Management

Triage and Categorize ITSM Incidents Agentic Workflow

A ServiceNow agentic workflow in IT Service Management that runs a team of three AI agents to autonomously set an incident's category and subcategory, assign service, service offering and configuration item, and link the incident to a related major incident or problem. Documented for the Australia release.

Recorded characteristics

Function
ServiceNow documents this as an AI agent team, not a single agent. Executed in order: the Categorize ITSM incident AI agent assigns Category and Subcategory from the incident short description and updates Work notes; the Classify service and CI AI agent assigns Service, Service offering and Configuration item and updates Additional comments and Work notes; the Link major incident or problem AI agent links the most similar major incident and ends the workflow, or, if none is found, links a matching ongoing problem, updating the parent incident or problem field and Additional comments. Triggering is automatic when State is New or updated to In progress, Assigned to is empty and Priority is 3, 4 or 5; triggering is manual when State is In progress and Assigned to is not empty. Documentation states all executions are autonomous and the workflow does not require user input during execution.
Data access
Reads the incident record, principally the short description and context, and searches services, service offerings, configuration items, major incidents and problems. Linking to related problems relies on semantic indexing of the Problem table when the workflow is duplicated. Writes are limited to the documented incident fields: Category, Subcategory, Service, Service offering, Configuration item, parent incident or problem, Work notes and Additional comments. No documented setting of assignment group, assignee, priority or incident state by this workflow.
Actions
Can take actions
External actions
Unknown
Human confirmation
Not required
Permission basis
Mixed
Administrative control
Configured in AI Agent Studio under Create and manage. Administrators control the trigger Active flag, the trigger user (a user with the itil role), each AI agent's Status on the Define availability screen, the Run as entity, and role-based access on the Select display screen where the itil role is added by default. Linking to major incidents requires activating the Incident Management - Major Incident Management plugin (com.snc.incident.mim). The workflow can be duplicated and modified.
Default state
Conditional
Availability
Documented for the Australia release (page updated 12 March 2026) and also present in Zurich documentation. Requires installation of the ServiceNow Otto for IT Service Management (ITSM) (sn_itsm_gen_ai) plugin and the Incident Management application. The workflow ships with the ITSM agentic AI application but must be activated by turning on the trigger and enabling each AI agent's status.
Licensing
Not established from ServiceNow documentation reviewed. No SKU or edition requirement is stated on the pages cited.
External model or provider
Not established. No model or model provider is named in the ServiceNow documentation for this workflow.
Limitations and uncertainty
Boundary: this record covers only the Triage and categorize ITSM incidents agentic workflow. The Investigate and resolve ITSM incidents workflow, the Wrap-up and resolve incident workflow, Incident assist, Generate post incident reviews and Major Incident Management capabilities are separate and are not covered here. Not established: outbound actions to external systems; the exact runtime role set of the ITSM Worker AI Agent user; whether any documented human approval step gates the field writes; model or provider; licensing SKU; and whether a formal preview or general-availability designation applies.

Evidence