--- sourceDocument: Australia Build or modify applications sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/pt-BR/application-development Release : - australia ft:locale : - pt-BR ft:publication_title : - Australia Build or modify applications ft:clusterId : - cadev bundleId : - cadev workflow : - Development, Data, and Analytics --- # Governance # Governance for vibe coding and AI-assisted app development {#ariaid-title1} * Versão de lançamento: Australia * * Atualizado 12 de mar. de 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 min. de leitura Vibe coding and AI-assisted app development on the ServiceNow AI Platform accelerates application development by using AI to generate code and configurations from natural language prompts. However, speed must not compromise security, compliance, and maintainability. Governance addresses: * Risk and compliance: AI-generated apps meet enterprise security standards and regulatory requirements. * Quality assurance: Automated code is validated through testing and review. * Visibility and control: Prevents shadow IT and enforces lifecycle transparency. {#vc-governance__ul_t5g_51g_phc} ServiceNow embeds security and governance directly into the vibe coding and AI-assisted development workflow, so AI-generated applications meet enterprise standards by default. Build Agent automatically generates Access Control Lists (ACLs) that enforce role-based access, validates scripts for security vulnerabilities, and applies code optimization during generation. Every app that's vibe coded and developed with AI on the ServiceNow AI Platform includes audit trails, security controls, and compliance checks without requiring explicit prompts for these features. Nota: Build Agent requires the admin role. ## Core governance principles {#vc-governance__section_oyx_v1g_phc} 1. Approval and oversight: * Use App Engine Management Center (AEMC) to approve app ideas and manage collaborators. * Require governance checkpoints before moving from sandbox in Developer Sandboxes to production. {#vc-governance__ul_n21_x1g_phc} 2. Controlled release management with ReleaseOps implementation practices: * Update sets and update set automation for version control. * Metadata-as-code pipelines for automated deployments. {#vc-governance__ul_p21_x1g_phc} 3. Secure development practices: * Enforce ACLs and role-based access for generated apps, which Build Agent can do. * Validate AI-generated scripts for security vulnerabilities. * Apply code optimization and review before publishing. {#vc-governance__ul_q21_x1g_phc} 4. Support for testing and validation: * Use Automated Test Framework (ATF) for functional and regression testing. Nota: If you're using Build Agent, it automatically updates failing metadata to resolve ATF test failures, without you needing to manually run ATF tests. * Include peer review for critical workflows and integrations. {#vc-governance__ul_r21_x1g_phc} 5. Isolation of work with Developer Sandboxes: * Experiment and develop in Developer Sandboxes to avoid impacting production. * Align with Git-style branching for concurrent development. {#vc-governance__ul_s21_x1g_phc} ## Governance checklist for apps built with AI assistance {#vc-governance__section_vts_kbg_phc} 1. App idea approved in AEMC. 2. ACLs and security roles applied. 3. Code reviewed and optimized. 4. ATF tests executed and passed. 5. Release pipeline validated. 6. Documentation generated (such as summaries and flow explainers). 7. Compliance and audit logs updated. ## Governance tools and resources {#vc-governance__section_yt4_pbg_phc} * App Engine Management Center: Governance hub for approvals and monitoring. For more information, see [App Engine Management Center](https://servicenow-prod.fluidtopics.net/h0q0n_PaK3tPkVkMK12IRg "The App Engine Management Center (AEMC) provides an innovative experience for you to manage the full life cycle for custom app development. You can use AEMC to handle application intake, configure pipelines, oversee developer productivity, and view insights about custom applications across your development environments, all in one centralized location."). * AI Control Tower monitors AI agent behavior, enforces guardrails, tracks AI-generated code changes, and provides dashboards showing which apps were created by Build Agent, what data they access, and how they comply with organizational policies. For more information, see [AI Control Tower](https://www.servicenow.com/docs/access?context=ai-control-tower-landing&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US). * ServiceNow Vault discovers and protects sensitive data across workflows, so AI-generated apps handle confidential information appropriately. For more information, see [ServiceNow Vault](https://www.servicenow.com/docs/access?context=servicenow-vault-landing&version=australia&pubname=australia-platform-security&ft:locale=en-US). * ReleaseOps Toolkit: Update set automation and metadata pipelines. For more information, see [ReleaseOps](https://servicenow-prod.fluidtopics.net/al3hlKK44SVWAPJk1IOg8A "ReleaseOps automates deployment of changes across your pipeline, increases predictability and reliability of deployments, and reduces the risk of releasing changes to production."). * Automated Test Framework: Automated testing for ServiceNow apps. For more information, see [Automated Test Framework (ATF)](https://servicenow-prod.fluidtopics.net/x4Tg~gX3EeFqtF9ohWlMNQ "The Automated Test Framework (ATF) enables you to create and run automated tests to confirm that your instance works after making a change. For example, after an upgrade, during application development, or when deploying instance configurations with update sets. Review failed test results to identify the changes that caused the failure and the changes that you should review."). * Developer Sandboxes: Develop in a secure, isolated Developer Sandboxes environment. For more information, see [Developer Sandboxes](https://servicenow-prod.fluidtopics.net/DJ1PDT22YvXFkRMRoC03Gg "Developer Sandboxes provide admins and delegated developers the ability to request, access, and manage individual sandboxes on top of the same underlying development instance. Delegated developers can write and merge code and configuration changes without the risk of their changes getting overwritten on the instance mid-development."). * Knowledge Base articles: Data handling and AI usage guidelines. For more information, see [Knowledge Management](https://www.servicenow.com/docs/access?context=knowledge-management&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US). {#vc-governance__ul_c3q_qbg_phc} ## Governance general guidelines {#vc-governance__section_avv_wcg_phc} When using vibe coding and AI-assisted development, prompts should not only describe functionality but also embed governance requirements. This helps generated apps comply with security, compliance, and quality standards. See [Example prompts for vibe coding and AI-assisted development](https://servicenow-prod.fluidtopics.net/J8eNpDSivnKb1FblagNsAw "Use these example prompts to build data models, implement security, create business rules, and generate user interfaces when building an app with ServiceNow AI Platform vibe coding and AI-assisted development tools.") for example prompts for governance.