ServiceNow A2A Governance: Why Agent Traffic Needs Scrutiny

What ServiceNow Built

ServiceNow has assembled what it calls Action Fabric, a three-part interoperability layer meant to let AI agents move freely in and out of its platform. The MCP Server Console exposes ServiceNow capabilities to outside AI clients. The MCP Client lets ServiceNow's own agents reach into external systems. A2A lets ServiceNow agents work alongside external agents as peers on shared tasks. 4 The company's community documentation presents these as complementary paths, with governance described as the thread tying them together. 4

The setup is no longer abstract. ServiceNow's newer AI workflow loop plugs directly into Action Fabric, so external agents such as Claude, Copilot and Moveworks can invoke governed ServiceNow actions, and ServiceNow agents can act in the other direction. 5

Three Paths, Three Governance Questions

The issue for enterprise buyers is structural. Each component sends traffic a different way. Under MCP, one side calls tools the other side publishes, and ServiceNow's console is built to publish, govern and observe the tools it exposes. 4 A2A is a different arrangement. Two agents delegate and coordinate work as peers rather than one calling the other's tool catalog. 34

That difference matters for oversight. A control point designed around tool calls will not automatically see or police what happens when two autonomous agents negotiate a task. Whether every path gets the same policy enforcement, logging and revocation is something buyers need to confirm for each path. They should not assume it from marketing that describes a single unified fabric.

Analyst Gogia makes the same point in different terms: interoperability through open protocols does not mean enforcement is equivalent. 5 Gogia argues that enterprises still need to verify two things. First, that they can revoke an agent's authority. Second, that audit evidence survives if they ever move to a different governance platform. 5 Anyone building multi-agent loops on MCP and A2A will face both questions.

The Standards Are Still Catching Up

The wider ecosystem explains why these gaps exist. MCP has matured quickly. It now sits under the Linux Foundation, and in 2026 it gained a standardized enterprise authentication layer covering OAuth, role-based access control and audit logging. 3 A2A, which Google started as the communication layer between agents, belongs to a newer stack. That stack now also includes Agentic Resource Discovery (ARD), an Apache 2.0 specification published June 17, 2026. Google and Microsoft released it with a coalition that includes ServiceNow. 3 ServiceNow is therefore helping write the standards that its own governance features will eventually have to enforce.

Public standards bodies are behind as well. NIST's Center for AI Standards and Innovation launched its AI Agent Standards Initiative on February 17, 2026. 2 One of its three pillars focuses on open-source protocol interoperability. The Cloud Security Alliance reads that pillar as an admission that agent-to-agent and tool-invocation protocols are developing faster than any vendor or standards body can track. 2 The initiative's first major normative output, an AI Agent Interoperability Profile, is not expected until Q4 2026. 12

Until then, the more established frameworks carry most of the weight. ISO/IEC 42001, the AI management system standard published in December 2023, has become a procurement checkbox. AWS, Microsoft and SAP have all achieved certification, and buyers increasingly require it from AI vendors. 1 These frameworks govern organizations and processes, though. They do not govern individual messages passing between agents.

Why the Audit Trail Is the Real Product

Zylos sums up the governance principle in one line: an agent can only be trusted as far as its audit trail allows, because you cannot govern what you cannot observe or attribute actions you never logged. 1 Measured against that standard, a protocol that moves work between agents without a matching record is a liability, however capable it is.

Our Reading

Action Fabric is a sensible architecture, and ServiceNow deserves credit for adopting open protocols instead of building a closed garden. Still, the most mature governance tooling across the industry is concentrated around MCP-style tool exposure. A2A peer collaboration is newer, less standardized, and harder to observe. The cautious assumption is that oversight is uneven across these paths until a vendor proves otherwise.

In practice, enterprises should not treat "governed" as one property that covers the whole fabric. They should ask, path by path, what gets logged, what can be blocked, and what can be revoked mid-task. A2A traffic needs the most scrutiny, because it is where agents act most autonomously and where the standards are least settled.