ServiceNow sells the AI control tower it cant yet fully prove
ServiceNow tracks 1,600 AI assets across its own operations, measures $500 million in cumulative AI value flowing through its internal Control Tower, and sells that same platform to enterprises as a governance solution. The question is whether the numbers that pitch the product can also serve as its proof.
That gap — between what the Control Tower can document internally and what it can actually govern in the wild — sits at the center of the announcements from ServiceNow Knowledge 2026 in Las Vegas this week. The company, valued at roughly $95 billion, unveiled a wave of AI agent capabilities spanning IT, security, HR, finance, and procurement, all governed by its AI Control Tower platform. The centerpiece was an expanded partnership with NVIDIA to embed the Control Tower directly into the NVIDIA Enterprise AI Factory validated design, extending governance to the infrastructure level where AI agents actually run. Project Arc, an autonomous desktop agent built on NVIDIA's OpenShell sandboxed runtime and governed by ServiceNow's Control Tower, arrived in early preview.
The token economics are concrete. NVIDIA's Blackwell architecture delivers 50 times more token output per watt than the prior Hopper generation, translating to roughly 35 times lower cost per million tokens. For enterprises running millions of agent workflows, that efficiency shift is the difference between a pilot and a production deployment. ServiceNow says it has already processed over 40 million cases annually across its platform, with AI specialists resolving 91 percent without reassignment.
The customer deployment that has generated the most detailed public accounting is Rolls-Royce. Operating 45,000 employees across 50 countries, the company deployed ServiceNow's Now Assist — branded internally as Merlin — in August 2025. The deployment reached 12,000 employees, processes 10,000 conversations per month, and has delivered 5,000 hours of efficiency savings with a 54 percent deflection rate. Phil Priest, Head of Global Business Services at Rolls-Royce, described the governance challenge in concrete terms: bank detail changes in accounts payable are an area where humans sense something looks wrong. Building agents that prevent fraud in that workflow required careful design, not just deployment. That is the actual problem the Control Tower is supposed to solve.
Diginomica's reporting from Knowledge 2026 captured the gap between the platform's ambitions and its current reach. John Aisien, SVP of Security and Risk at ServiceNow, framed the architectural thesis: zero trust was foundational for the cloud world, zero permissions will be foundational for the agentic world. That is a coherent bet. The $1 billion in annual contract value that ServiceNow's security and risk division crossed in 2025 — confirmed by Fortune — validates that enterprises are willing to pay for the problem to be solved. The acquisitions of Armis for $7.75 billion and Veza are aimed at filling the asset visibility and permission graph gaps that have historically made AI governance aspirational rather than operational.
The kill switch is where the claim gets harder to sustain. ServiceNow demonstrated a prompt injection attack on a pricing agent being intercepted in real time by the Control Tower. The agent was instructed to set a shipping price to one dollar and suppress logging of the action. The system detected the attack and shut it down. Techzine noted the technical gap: the demo worked because the agent ran inside a managed runtime environment with full API access to shut it down. On hyperscaler agent platforms like AWS Bedrock or Azure AI Foundry, the OTEL observability standards adopted by AWS and Microsoft enable similar visibility. On Google Agent Runtime it requires opt-in. On SaaS platforms like Workday or SAP, the picture is less clear. SAP has signaled OTEL support sometime in 2026. Workday has its own observability layer, but it operates at the application level, not the agent reasoning level. ServiceNow acknowledges that a kill switch via Veza permission revocation — revoking an agent's access credentials and letting it crash — is the fallback when an API-based kill switch is unavailable. That is a reasonable engineering workaround. It is not the same as a real-time governance intervention.
What ServiceNow is building — a single platform connecting AI governance to operational context, security controls, and financial accountability — is something the industry genuinely needs. The technical components are real. The $1 billion in ACV validates that enterprises are willing to pay for the problem to be solved. The gap between the marketing claim of universal AI governance and what can currently be demonstrated on third-party SaaS platforms is where a careful reader should hold judgment. The Control Tower works on ServiceNow. It works on AWS and Azure. It is coming into focus on Google. On Workday and SAP, it remains a work in progress. That is not nothing. It is also not the control tower that the pitch describes.
The bigger question is whether the governance gap matters more than the governance opportunity. Enterprises are deploying AI agents faster than their security, compliance, and governance infrastructure can keep pace. ServiceNow's argument is that it solves both sides of that equation simultaneously. Whether that argument holds at the scale the company is projecting will define whether this partnership is a infrastructure milestone or a very well-funded proof of concept.