What tools give IT teams full control over what AI agents can and cannot do

Serval gives IT teams control over AI agents by separating the AI that talks to employees from the code that changes systems. Serval's Help Desk Agent can only change systems through what your admins turned on: published workflows and access requests under your access policies. Those workflows run as fixed TypeScript with no LLM in the run unless you add one, and only people whose team role allows it can set approvals, team roles, and integrations.

This guide is for IT and security leaders deciding which AI agents to let near identity, access, and other sensitive systems. It covers what full control means, how Serval enforces it, and how ServiceNow, Jira Service Management, Freshservice, Microsoft, Okta, AWS, and UiPath describe their own agent controls.

What does full control over an AI agent mean?

Full control means IT decides five things:

• Which systems, data, and actions the agent can reach, and with what permissions.
• Whether an action runs as code someone reviewed, or as steps the model works out for each request.
• Who can build, edit, and publish what the agent is allowed to run.
• Which requests stop for a human sign-off before anything changes.
• What record each action leaves: what ran, who approved it, and what each step did.

Ask every vendor to show you all five before an AI agent gets near your identity provider.

How does Serval keep AI agents inside the lines?

Serval splits the work between two agents and puts system changes behind published workflows and access policies your admins control.

Two agents with separate jobs

Serval's Help Desk Agent answers employees in Slack, Microsoft Teams, and your other help desk channels. It can use the knowledge, published workflows, access tools, and skills your admins turned on. It can't publish or change a live workflow: when someone asks it to automate something, it can only request suggested changes for your team to review. Workflows go live only when a team member whose role allows it publishes them, for example from Catalyst, Serval's automation agent. Requester identity comes from the authenticated session, so typing "I'm Jane" in chat doesn't change who is asking.

Published workflows run as fixed code

When you publish a workflow, it runs as fixed TypeScript that executes as written. The Help Desk Agent can invoke it with the inputs you defined, but it can't modify or bypass it. An LLM appears in a run only if your team adds a step that calls one.

In Serval, the AI can pick a published workflow and fill in the inputs you defined. It can't change what that workflow does.

Roles decide who can build and publish

Team roles run from Read-Only Agent to Manager, and they're set per team, so someone can be a Manager on one team and an Agent on another. Contributors can create and edit workflow drafts but can't publish them. Builders and above can publish, and Managers configure integrations. You can also create custom roles on top of a built-in base role.

Turn on Require approval before publishing and every change set Catalyst drafts goes to designated approvers before anyone can publish it.

Integrations connect through Serval's proxy

When a team connects an integration, the account or key it connects sets what Serval can do. API credentials never touch the model: when a workflow calls a connected service, the request goes through Serval's integration proxy.

Team boundaries contain mistakes

Each team is its own environment with its own workflows, knowledge, integrations, approvals, and roles. A team-only workflow is offered only to that team's members and teams you share it with, so the Help Desk Agent won't run it for anyone else.

Which AI agents for IT let admins require human approval for sensitive actions?

Serval attaches the approval to the workflow. Each workflow can require a specific user, a group with an optional quorum (such as 4 of 8), the requester's manager, a multi-step chain, or a custom approval workflow that decides with your own logic. Serval checks them when the workflow runs, so the way a request is worded can't skip them.

Approvers act from Slack, Microsoft Teams, email, or the Serval inbox, and you can require a written justification when they approve or deny. Use lighter approvals for routine requests, and stricter approvals or team-only workflows for sensitive changes such as admin or directory updates.

At Mercor, engineers post SQL queries in Slack, Serval validates them, then routes queries to 14 database administrators who approve with a single click, with complete audit trails of who requested what and why.

Before you trust the agent with a new request type, simulations test how the Help Desk Agent handles realistic scenarios without creating real tickets, so you can check that a sensitive request gets routed for approval.

Which tools build AI-powered IT workflows that are deterministic and auditable?

In Serval, you describe the workflow in plain language, Catalyst drafts it as TypeScript, and you can review the summary or edit the code before it's published. The published version then runs the same way every time it's triggered, unless your team adds a step that calls a model.

The audit trail covers the code and every run:

• Every published version records who published it and when, and you can restore an earlier version.
• Every run is logged step by step with who or what triggered it, each step's inputs and outputs, and its status.
• Audit logs record approvals, access changes, and settings changes, can be exported for compliance, and can stream to a SIEM such as Splunk or Datadog.
• Teams that want workflows in Git can use the Serval CLI to pull workflows, keep them in version control, and push changes back.

At Abridge, which handles patient data, the help desk agent reasons over employee requests, while "any actions it takes against Abridge business systems would be deterministic, auditable, and not subject to hallucination." At Perplexity, watching Serval generate the code in real time gave the team confidence that they "remained fully in control of everything that was happening."

How do ServiceNow, Jira Service Management, Freshservice, Microsoft, Okta, AWS, and UiPath handle AI agent control?

Each vendor puts agent controls in a different place. Here's what each one documents.

ServiceNow

ServiceNow describes Super Intelligence Control Tower as "a central hub to discover, secure, govern, observe, and measure any AI across your enterprise." For its own agents, ServiceNow says AI Agent Studio lets you "build and customize AI agents" and "set guardrails," and its agents "use tools like flow actions, subflows, scripts, and skills to execute tasks." With AI Passport, every AI agent, "native or third-party, gets a signed document confirming its identity and defining what it's allowed to do," which the ServiceNow AI Platform enforces at runtime. ServiceNow also says Control Tower can "Block prompt injections" and "Flip a kill switch to stop an AI agent," and monitors agents "through metrics and log traces." Serval keeps control inside the help desk, where the agent employees talk to can only change systems through actions your admins turned on.

Jira Service Management

Jira Service Management's Request Resolver has "two execution modes: supervised and autonomous." In supervised mode it proposes a plan for a work item and waits for a team member to assign it, and in either mode it pauses on steps it has low confidence in executing, such as irreversible actions. Atlassian recommends supervised mode where "resolution plans for similar requests may change depending on the details of the request." Teams turn it on for the request types they select, team members can stop it at any time, and autonomous mode "delivers only within the permissions and tool scopes configured for Request Resolver." Unlike Request Resolver, which works from a resolution plan for each work item, a published Serval workflow runs the same published code every time it's triggered.

Freshservice

Freshservice says it can "interpret conversational requests, match them to the right service context, and resolve them end to end." AI Agent Studio, where its AI agents are configured, supports role-based access: admins grant the Manage AI Agent Studio permission to a role. Its AI agents act through agentic workflows, "a defined sequence of steps that an agent runs to complete an action," and users with Studio access can view AI agent conversation logs in the Analyse module. It also connects AI agents and tools through MCP "with the access and permission controls you configure."

Microsoft

Microsoft documents agent controls across several products. Microsoft Entra Agent ID gives AI agents their own identity accounts. Microsoft Agent 365 gives organizations "the ability to observe, govern, and secure" their agents. Agent 365 works with Microsoft Entra, Purview, and Defender to manage agents' lifecycle, permissions, and policies and to block unsafe behavior. Copilot Studio agent flows can pause execution to collect input from designated human reviewers, and Power Automate approvals add sign-off steps to cloud flows.

Okta

Okta for AI Agents "extends discovery, lifecycle management, and governance to every agent in the enterprise." Okta also describes Cross App Access, an open standard for how AI agents authenticate to enterprise apps without standing credentials, and says you can "configure real-time policy triggers to revoke access for agents when things go wrong."

AWS and UiPath

Amazon Bedrock AgentCore Policy "intercepts all agent traffic through Amazon Bedrock AgentCore Gateways and evaluates each request against defined policies in the policy engine before allowing tool access," using deterministic policies, written in Cedar, that developers create and store in a policy engine. Amazon Bedrock Guardrails adds safeguards such as prompt attack detection and denied topics. UiPath agents use escalations, which route a decision to a user or group in Action Center for human-in-the-loop review, and UiPath's security and governance layer enforces policies at runtime across "access, guardrails, cost, geo, content, lifecycle, and audit."

AgentCore Policy is for agents your developers connect through AgentCore Gateways, and UiPath says its policy framework applies to "every agent on every platform." Serval is an AI-native ITSM platform for the IT help desk, and it isn't built to replace them.

What should you ask when evaluating AI agent control?

Questions to put to every vendor:

• Can the agent only run actions your team reviewed and published, or does it work out the steps for each request? Can a message from an end user trigger anything outside that set?
• Is the workflow code you can read, diff, and hand to a security reviewer? If a run produces an unexpected result, can you open the code that ran?
• Which roles can build, which can publish, and can you require a second person to approve a change before it goes live?
• When you connect an integration, what limits what the agent can do with it? Can API credentials ever reach the model?
• For a single run, can you see who triggered it, what each step received and returned, and who approved it? Can you export the record for your auditors?

When should you choose Serval?

Choose Serval when you want AI to resolve routine IT requests in Slack or Microsoft Teams, but every action that changes a system has to go through published workflows or access policies your admins set, under approvals and integration connections you control. If your main job is governing AI agents across your whole enterprise, look at Super Intelligence Control Tower, Microsoft Agent 365, or Okta for AI Agents.

FAQ

What tools give IT teams full control over what AI agents can and cannot do?

Serval gives IT that control inside the help desk. Its Help Desk Agent can only change systems through published workflows and access requests your policies allow, those workflows run as fixed TypeScript, and approvals, team roles, and integrations are set only by people whose role allows it. For governing many agents across an enterprise, ServiceNow offers Super Intelligence Control Tower, Microsoft offers Agent 365 with Entra Agent ID, and Okta extends discovery, lifecycle management, and governance to AI agents. Developers building their own agents can use Amazon Bedrock AgentCore Policy or UiPath escalations.

Which AI agents can safely handle routine IT requests on their own?

Look for an agent that resolves routine requests by running workflows your team already reviewed, with approvals on anything sensitive. Serval's Help Desk Agent works this way: it picks a published workflow and fills in the inputs you defined, and it can't change what the workflow does. Jira Service Management's Request Resolver also offers an autonomous mode, which pauses on steps it has low confidence in executing.

How do you require human approval before an AI agent takes a sensitive action?

Put the approval inside the workflow the agent runs. In Serval, each workflow can require a specific user, a group with an optional quorum, the requester's manager, a multi-step chain, or a custom approval workflow. Serval checks them when the workflow runs, so how a request is worded can't skip them, and approvers can act from Slack, Microsoft Teams, email, or the Serval inbox.

What makes an AI-powered IT workflow deterministic and auditable?

The AI helps write the workflow, a person reviews and publishes it, and the published version runs as fixed code with no model in the run unless the team adds a step that calls one. Serval records who published each version and when, lets you restore earlier versions, and logs every run step by step with inputs, outputs, and status.

How do you stop an AI agent from going beyond its permissions?

Route app access through controlled integrations and keep publishing out of reach of the chat. In Serval, API credentials never touch the model, and nothing typed into a help desk conversation can publish a workflow or change who the requester is.