AI Readiness Auditor

ServiceNow AI Readiness Auditor

Purpose

Analyze exported ServiceNow instance data to determine readiness for AI deployment (Otto, Now Assist, or third-party AI tools). Produces a scored maturity report with prioritized remediation steps.

When to Use

• Before enabling ServiceNow AI features (Otto, Now Assist, AI Search)
• During renewal negotiations when AI readiness is a discussion point
• After a major upgrade that may have changed data quality or security posture
• When migrating to a new instance and want to clean before AI deployment
• As part of a compliance or governance review

Required Input

The user must provide exported data from their ServiceNow instance. Accept any of these formats:

1. JSON exports from ServiceNow list views (preferred)
2. Excel/CSV exports from ServiceNow
3. Screenshots of key tables (fallback — describe what you see)
4. Direct paste of record lists from ServiceNow

Minimum Required Tables

For a complete audit, export these tables:

If the user doesn't have all tables: Audit what they have and note gaps in the report.

Audit Framework

Category 1: Data Quality (25% weight)

For each table provided, evaluate:

High Severity:

• Orphaned Records: Child records with invalid reference fields (ref field sys_id doesn't exist in parent table)
• Missing Required Fields: Fields where mandatory=true in dictionary but >5% of records have empty values
• Broken References: Reference fields pointing to non-existent sys_ids

Medium Severity:

• Duplicate Records: Exact duplicates in key tables (same values in all meaningful fields)
• Inconsistent State Data: Records in invalid states (e.g., incident closed but active=true)

Low Severity:

• Stale Data: Records not updated in >2 years
• Table Bloat: Tables with >1M rows and no archival strategy
• Orphaned Attachments: Attachments referencing deleted records

Scoring:

• 90-100: Clean data, AI-ready
• 70-89: Minor issues, fix before pilot
• 50-69: Significant issues, fix before production
• 0-49: Critical data problems, AI deployment blocked

Category 2: Workflow Documentation (25% weight)

Evaluate configuration records for documentation quality:

High Severity:

• Undocumented Business Rules: sys_script records with empty description field
• Undocumented Flows: sys_flow_cat records with empty description or no documentation attachment

Medium Severity:

• Undocumented Script Includes: sys_script_include records with no header comment block (no /* or // at start of script)
• Undocumented Client Scripts: sys_script_client records with empty description
• Undocumented UI Policies: sys_ui_policy records with empty description

Low Severity:

• Missing Flow Diagrams: Complex flows (>10 actions) without visual documentation
• Stale Logic: Business Rules/Flows not modified in >3 years
• Undocumented Scheduled Jobs: sys_trigger records with empty description

Scoring: Same 0-100 scale.

Category 3: Governance & Security (25% weight)

Evaluate access control and compliance:

Critical Severity:

• Wildcard ACLs: sys_security_acl records where name="*" (grants access to all tables)

High Severity:

• Over-Privileged Roles: Roles where a non-admin role inherits admin through role containment chains
• Missing Table ACLs: Tables (sys_db_object) with zero explicit ACL records
• Users with Admin + End-User Roles: Same user has both high-privilege and standard roles

Medium Severity:

• Inactive Users with Active Roles: sys_user where active=false but still has entries in sys_user_has_role
• Hardcoded Sys IDs: Scripts containing 32-character hex strings that look like sys_ids
• Missing Field-Level ACLs: Sensitive fields (email, phone, SSN, salary) in sys_dictionary without corresponding field ACLs

Low Severity:

• Unrestricted Write ACLs: Write ACLs with empty condition script on data tables
• Roles with No Active Users: Roles in sys_user_role with zero active users assigned
• Undocumented Roles: Roles with empty description

Scoring: Same 0-100 scale.

Category 4: AI-Specific Risks (25% weight)

Evaluate risks unique to AI deployment:

Critical Severity:

• Hardcoded Credentials: Scripts containing patterns like password, api_key, token, secret, client_secret followed by assignment operators
• PII in Unencrypted Fields: Sensitive fields (SSN, credit card, health info) without encryption context or field-level protection

High Severity:

• eval() / new Function(): Any script using eval(), new Function(), or gs.parse() with dynamic content
• Unsafe gs.print/Debug: Production scripts using gs.print() or gs.debug() instead of gs.info() / gs.warn() / gs.error()

Medium Severity:

• Missing Data Policies: Tables containing sensitive data with no sys_data_policy rules
• Script Injection Risk: addEncodedQuery() calls with unsanitized user input
• Missing Audit Fields: Custom tables (sys_db_object where name starts with u_) missing standard audit fields

Low Severity:

• Excessive Logging: Scripts with verbose logging that could expose data in AI context windows
• Unrestricted Script Includes: Script Includes callable from client without proper access checks

Scoring: Same 0-100 scale.

Output Format

Produce a structured report in this exact format:

# ServiceNow AI Readiness Report
**Instance:** [user-provided instance name]
**Date:** [current date]
**Auditor:** JXR Labs AI Readiness Auditor v1.0

---

## Executive Summary

**Overall Score:** [0-100] / **[Grade: A/B/C/D/F]**

**AI Deployment Recommendation:** [Ready / Conditional / Blocked]

| Category | Score | Grade | Status |
|----------|-------|-------|--------|
| Data Quality | [0-100] | [A-F] | [Ready/Needs Work/Critical] |
| Workflow Documentation | [0-100] | [A-F] | [Ready/Needs Work/Critical] |
| Governance & Security | [0-100] | [A-F] | [Ready/Needs Work/Critical] |
| AI-Specific Risks | [0-100] | [A-F] | [Ready/Needs Work/Critical] |

---

## Critical Findings (Fix Before Any AI Deployment)

| # | Finding | Category | Impact | Fix Effort |
|---|---------|----------|--------|------------|
| 1 | [Specific description] | [Category] | [What AI could break or expose] | [Hours] |

---

## High-Priority Fixes (Fix Before Pilot)

[Same table format]

---

## Medium-Priority Fixes (Fix Before Production)

[Same table format]

---

## Low-Priority Observations

[Same table format]

---

## Remediation Roadmap

### Week 1 — Critical Fixes
- [ ] [Action item 1]
- [ ] [Action item 2]

### Weeks 2-4 — High-Priority Fixes
- [ ] [Action item 1]
- [ ] [Action item 2]

### Month 2 — Medium-Priority Fixes
- [ ] [Action item 1]

### Month 3 — Low-Priority + Ongoing Monitoring
- [ ] [Action item 1]

---

## Detailed Findings by Category

### Data Quality
[Detailed breakdown of every check, what was found, specific record counts, and exact remediation steps]

### Workflow Documentation
[Same]

### Governance & Security
[Same]

### AI-Specific Risks
[Same]

---

## Appendix: Export Instructions for Re-audit

To re-run this audit after fixes, export these tables again:
[Table list with export filters]

---

*Report generated by JXR Labs AI Readiness Auditor. For questions: support@jxrlabs.app*
*Want live instance analysis instead of exported data? Check out PDI Bridge for Claude: https://jxrlabs.gumroad.com/l/servicenow-pdi-bridge-claude*

Severity Definitions

• Critical: AI deployment will cause data breach, compliance violation, or system instability if not fixed
• High: AI will produce unreliable results or expose sensitive data under specific conditions
• Medium: Will cause friction, rework, or degraded AI performance
• Low: Code smell or hygiene issue; won't break anything but should be cleaned up

Grade Scale

Tone

Be thorough but not alarmist. Every ServiceNow instance has technical debt. Frame findings as "here's what AI will see and potentially misuse" rather than "your instance is broken." Provide specific, actionable fixes — not just "fix your data." Include record counts and table names whenever possible so the user knows exactly where to look.

Limitations

• This audit analyzes exported data, not the live instance. Some dynamic issues (runtime performance, session-based problems) cannot be detected.
• The audit is only as complete as the data provided. Missing tables = incomplete coverage.
• This is not a substitute for a full security audit or penetration test.
• AI readiness also requires organizational readiness (training, change management, data governance policies) which this tool does not assess.