Before
Security or compliance teams had to monitor approval responses in ServiceNow and repeatedly check whether every reviewer had responded. After reaching a verdict, they manually updated the tool register, changed web-security controls, closed the review, identified recent users, and prepared individual notifications across multiple systems.
How it works
- Receive an approval change and retrieve all approvals plus the associated Shadow AI review.
- Determine whether the review is blocked, approved, tolerated, restricted, or still pending, while ignoring already completed decisions.
- For a final verdict, update the register and security controls, close the review with its audit details, and notify users who accessed the tool within seven days.
Workflow details
- Approval evaluation: When an approver approves or rejects an AIR review, the workflow retrieves the complete approval set and the associated tool review. A single rejection produces a blocked verdict, while unanimous approval uses the review's decision or recommendation; incomplete approvals remain pending.
- Decision safeguards: The workflow avoids repeating actions when a review is already closed or the tool already has a final status. Pending reviews receive a tracking note identifying the latest response and the approvers still outstanding.
- Record and enforcement: For a final decision, the workflow updates the tool register with its status, permitted data level, decision date, and next review date. Blocked tools receive a 12-month review interval, while other decisions receive a 6-month interval, and the corresponding controls are applied in the organization's web security systems.
- Review closure: The ServiceNow review is closed with the decision, permitted data scope, approving or rejecting users, and the resulting security-control status, creating a consolidated record of the outcome.
- User communication: The workflow identifies users who accessed the tool during the previous seven days and sends them the decision, the type of data they may place in the tool, and any available alternative.
What changed
A final verdict now automatically triggers the registry update, security-control enforcement, review closure, and user communication in sequence. Pending approvals generate a follow-up note instead, while completed reviews and webhook replays are skipped without duplicating actions.
Work removed
Manually cross-checking every approval response, determining whether a final verdict has been reached, updating registry status and review dates, applying web-security controls, closing the review, finding recent users, and sending decision notifications.
Expected outcome
A reasonable planning estimate is 10–15 recurring manual actions removed per completed review, with decisions and notifications applied consistently once the approval outcome is final.
