# AI Readiness Auditor

> Analyze exported ServiceNow instance data for AI deployment readiness. Scores data quality, workflow documentation, governance, and AI-specific risks. Produces a prioritized remediation roadmap with specific fixes.

- Skill: `jxrlabs/ai-readiness-auditor` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add jxrlabs/ai-readiness-auditor`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jxrlabs/ai-readiness-auditor/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- Author: JXRLABS (https://skillmd.com/u/jxrlabs)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/jxrlabs/ai-readiness-auditor

---


# ServiceNow AI Readiness Auditor

## Purpose

Analyze exported ServiceNow instance data to determine readiness for AI deployment (Otto, Now Assist, or third-party AI tools). Produces a scored maturity report with prioritized remediation steps.

## When to Use

- Before enabling ServiceNow AI features (Otto, Now Assist, AI Search)
- During renewal negotiations when AI readiness is a discussion point
- After a major upgrade that may have changed data quality or security posture
- When migrating to a new instance and want to clean before AI deployment
- As part of a compliance or governance review

## Required Input

The user must provide **exported data** from their ServiceNow instance. Accept any of these formats:

1. **JSON exports** from ServiceNow list views (preferred)
2. **Excel/CSV exports** from ServiceNow
3. **Screenshots of key tables** (fallback — describe what you see)
4. **Direct paste** of record lists from ServiceNow

### Minimum Required Tables

For a complete audit, export these tables:

| Table | Why It's Needed | Records Needed |
|-------|----------------|----------------|
| `sys_script` | Business Rules | All (or active ones) |
| `sys_flow_cat` | Flow Designer flows | All |
| `sys_script_include` | Script Includes | All |
| `sys_script_client` | Client Scripts | All |
| `sys_security_acl` | ACL rules | All |
| `sys_user_role` | Roles | All |
| `sys_user_has_role` | User-role assignments | All |
| `sys_user` | Users | All (active and inactive) |
| `sys_db_object` | Table definitions | All |
| `sys_dictionary` | Field definitions | All |
| `sys_data_policy` | Data Policies | All |
| `sys_metadata` | All customizations | All (optional but recommended) |

**If the user doesn't have all tables:** Audit what they have and note gaps in the report.

---

## Audit Framework

### Category 1: Data Quality (25% weight)

For each table provided, evaluate:

**High Severity:**
- **Orphaned Records:** Child records with invalid reference fields (ref field sys_id doesn't exist in parent table)
- **Missing Required Fields:** Fields where `mandatory=true` in dictionary but >5% of records have empty values
- **Broken References:** Reference fields pointing to non-existent sys_ids

**Medium Severity:**
- **Duplicate Records:** Exact duplicates in key tables (same values in all meaningful fields)
- **Inconsistent State Data:** Records in invalid states (e.g., incident closed but active=true)

**Low Severity:**
- **Stale Data:** Records not updated in >2 years
- **Table Bloat:** Tables with >1M rows and no archival strategy
- **Orphaned Attachments:** Attachments referencing deleted records

**Scoring:**
- 90-100: Clean data, AI-ready
- 70-89: Minor issues, fix before pilot
- 50-69: Significant issues, fix before production
- 0-49: Critical data problems, AI deployment blocked

### Category 2: Workflow Documentation (25% weight)

Evaluate configuration records for documentation quality:

**High Severity:**
- **Undocumented Business Rules:** `sys_script` records with empty `description` field
- **Undocumented Flows:** `sys_flow_cat` records with empty `description` or no documentation attachment

**Medium Severity:**
- **Undocumented Script Includes:** `sys_script_include` records with no header comment block (no `/*` or `//` at start of script)
- **Undocumented Client Scripts:** `sys_script_client` records with empty `description`
- **Undocumented UI Policies:** `sys_ui_policy` records with empty `description`

**Low Severity:**
- **Missing Flow Diagrams:** Complex flows (>10 actions) without visual documentation
- **Stale Logic:** Business Rules/Flows not modified in >3 years
- **Undocumented Scheduled Jobs:** `sys_trigger` records with empty `description`

**Scoring:** Same 0-100 scale.

### Category 3: Governance & Security (25% weight)

Evaluate access control and compliance:

**Critical Severity:**
- **Wildcard ACLs:** `sys_security_acl` records where `name="*"` (grants access to all tables)

**High Severity:**
- **Over-Privileged Roles:** Roles where a non-admin role inherits `admin` through role containment chains
- **Missing Table ACLs:** Tables (`sys_db_object`) with zero explicit ACL records
- **Users with Admin + End-User Roles:** Same user has both high-privilege and standard roles

**Medium Severity:**
- **Inactive Users with Active Roles:** `sys_user` where `active=false` but still has entries in `sys_user_has_role`
- **Hardcoded Sys IDs:** Scripts containing 32-character hex strings that look like sys_ids
- **Missing Field-Level ACLs:** Sensitive fields (email, phone, SSN, salary) in `sys_dictionary` without corresponding field ACLs

**Low Severity:**
- **Unrestricted Write ACLs:** Write ACLs with empty `condition` script on data tables
- **Roles with No Active Users:** Roles in `sys_user_role` with zero active users assigned
- **Undocumented Roles:** Roles with empty `description`

**Scoring:** Same 0-100 scale.

### Category 4: AI-Specific Risks (25% weight)

Evaluate risks unique to AI deployment:

**Critical Severity:**
- **Hardcoded Credentials:** Scripts containing patterns like `password`, `api_key`, `token`, `secret`, `client_secret` followed by assignment operators
- **PII in Unencrypted Fields:** Sensitive fields (SSN, credit card, health info) without encryption context or field-level protection

**High Severity:**
- **eval() / new Function():** Any script using `eval()`, `new Function()`, or `gs.parse()` with dynamic content
- **Unsafe gs.print/Debug:** Production scripts using `gs.print()` or `gs.debug()` instead of `gs.info()` / `gs.warn()` / `gs.error()`

**Medium Severity:**
- **Missing Data Policies:** Tables containing sensitive data with no `sys_data_policy` rules
- **Script Injection Risk:** `addEncodedQuery()` calls with unsanitized user input
- **Missing Audit Fields:** Custom tables (`sys_db_object` where `name` starts with `u_`) missing standard audit fields

**Low Severity:**
- **Excessive Logging:** Scripts with verbose logging that could expose data in AI context windows
- **Unrestricted Script Includes:** Script Includes callable from client without proper access checks

**Scoring:** Same 0-100 scale.

---

## Output Format

Produce a structured report in this exact format:

```markdown
# ServiceNow AI Readiness Report
**Instance:** [user-provided instance name]
**Date:** [current date]
**Auditor:** JXR Labs AI Readiness Auditor v1.0

---

## Executive Summary

**Overall Score:** [0-100] / **[Grade: A/B/C/D/F]**

**AI Deployment Recommendation:** [Ready / Conditional / Blocked]

| Category | Score | Grade | Status |
|----------|-------|-------|--------|
| Data Quality | [0-100] | [A-F] | [Ready/Needs Work/Critical] |
| Workflow Documentation | [0-100] | [A-F] | [Ready/Needs Work/Critical] |
| Governance & Security | [0-100] | [A-F] | [Ready/Needs Work/Critical] |
| AI-Specific Risks | [0-100] | [A-F] | [Ready/Needs Work/Critical] |

---

## Critical Findings (Fix Before Any AI Deployment)

| # | Finding | Category | Impact | Fix Effort |
|---|---------|----------|--------|------------|
| 1 | [Specific description] | [Category] | [What AI could break or expose] | [Hours] |

---

## High-Priority Fixes (Fix Before Pilot)

[Same table format]

---

## Medium-Priority Fixes (Fix Before Production)

[Same table format]

---

## Low-Priority Observations

[Same table format]

---

## Remediation Roadmap

### Week 1 — Critical Fixes
- [ ] [Action item 1]
- [ ] [Action item 2]

### Weeks 2-4 — High-Priority Fixes
- [ ] [Action item 1]
- [ ] [Action item 2]

### Month 2 — Medium-Priority Fixes
- [ ] [Action item 1]

### Month 3 — Low-Priority + Ongoing Monitoring
- [ ] [Action item 1]

---

## Detailed Findings by Category

### Data Quality
[Detailed breakdown of every check, what was found, specific record counts, and exact remediation steps]

### Workflow Documentation
[Same]

### Governance & Security
[Same]

### AI-Specific Risks
[Same]

---

## Appendix: Export Instructions for Re-audit

To re-run this audit after fixes, export these tables again:
[Table list with export filters]

---

*Report generated by JXR Labs AI Readiness Auditor. For questions: support@jxrlabs.app*
*Want live instance analysis instead of exported data? Check out PDI Bridge for Claude: https://jxrlabs.gumroad.com/l/servicenow-pdi-bridge-claude*
```

---

## Severity Definitions

- **Critical:** AI deployment will cause data breach, compliance violation, or system instability if not fixed
- **High:** AI will produce unreliable results or expose sensitive data under specific conditions
- **Medium:** Will cause friction, rework, or degraded AI performance
- **Low:** Code smell or hygiene issue; won't break anything but should be cleaned up

## Grade Scale

| Score | Grade | Meaning |
|-------|-------|---------|
| 90-100 | A | AI-ready, minor observations only |
| 80-89 | B | Ready for pilot, fix high-priority items within 30 days |
| 70-79 | C | Conditional — fix high and medium items before production |
| 60-69 | D | Blocked — significant issues must be resolved first |
| 0-59 | F | Critical — AI deployment not recommended |

## Tone

Be thorough but not alarmist. Every ServiceNow instance has technical debt. Frame findings as "here's what AI will see and potentially misuse" rather than "your instance is broken." Provide specific, actionable fixes — not just "fix your data." Include record counts and table names whenever possible so the user knows exactly where to look.

## Limitations

- This audit analyzes exported data, not the live instance. Some dynamic issues (runtime performance, session-based problems) cannot be detected.
- The audit is only as complete as the data provided. Missing tables = incomplete coverage.
- This is not a substitute for a full security audit or penetration test.
- AI readiness also requires organizational readiness (training, change management, data governance policies) which this tool does not assess.