OpenAI and ServiceNow MCP plugin: ChatGPT acts, ServiceNow rules

OpenAI and ServiceNow expanded their partnership on October 28, and the useful part is the design, not the press release. The new ServiceNow MCP plugin for ChatGPT lets a user find incidents, check change risk and update records from inside a chat. But ChatGPT doesn't get the keys. ServiceNow's own business rules, permissions and approvals decide what actually happens. That is the right way to wire an AI agent into any system you run, and you don't need ServiceNow to copy it.

What actually happened

Per the joint Business Wire release and OpenAI's announcement:

• ServiceNow MCP plugin: live in the OpenAI marketplace now, with more capabilities expected by the end of 2026. It runs on ServiceNow Action Fabric, which applies ServiceNow's business rules, permissions and approvals to every action. In the release's words, ServiceNow stays where actions are "executed and governed."
• Security tooling: a joint product that uses OpenAI's cyber capabilities plus ServiceNow's asset and access data to triage attack paths. Early access is set for January 2027, with general availability planned for Q2 2027.
• Codex in AI Workflow Factory: OpenAI models will power ServiceNow's Build Agent and Autonomous Engineer. Availability: 2027.
• Voice risk assessments in ServiceNow's Control Tower governance product: preview in Q1 2027.
• Internal use: OpenAI plans to run its operations on ServiceNow, and ServiceNow plans to give its employees ChatGPT Work and Codex.

No financial terms were disclosed. Everything past the plugin is a roadmap date, and the release carries the usual forward-looking caveats.

Why it matters for your business

Most small businesses won't buy ServiceNow. The pattern is still the lesson: the agent asks, the system of record decides.

When we connect an AI agent to a client's CRM, order system or job board, the tempting shortcut is an admin API key in the agent's config. That makes the model your permission system. A wrong tool call, or a prompt injected through a customer email, then runs with full rights.

The Action Fabric design avoids that. Concretely:

Expose actions, not tables. Give the agent update_ticket_status or issue_refund_under_50, not raw write access. Each MCP tool should map to one business action.

Check permissions server-side, per user. The tool runs as the person in the chat, with their role. If they can't do it in your app, the agent can't do it for them.

Put approvals in the backend. A refund over a limit should wait for a human in your system, whatever the chat says.

Log in the system of record. The audit trail belongs next to the data, not in a chat transcript.

Sources: Business Wire via FinancialContent: ServiceNow and OpenAI accelerate enterprise AI, OpenAI: OpenAI and ServiceNow expand partnership across enterprise workflows.