HOW IT WORKS

Everything that happens
between your question
and your click.

One turn, start to finish, with nothing skipped over. The short version is that the agent can read a great deal and can write nothing — it can only ever hand you something to sign off, and the list of things it can hand you is three items long.

THE ANATOMY OF ONE TURN
Seven beats. Two of them are yours, and they are the two that change anything.
  1. YOU
    Which of my P1s are breaching, and has anyone fixed this VPN thing before?

    Plain language. No syntax to learn, and no need to know which table the answer lives in.

  2. KADDIYA
    It works out what to ask your instance

    The model picks from a fixed catalog of tools — it cannot invent a new one, and none of the ones it can pick writes anything. Every call it makes carries your OAuth token, so the instance answers it exactly as it would answer you.

  3. YOUR INSTANCE
    The queries run, on screen, as they run
    QUERY · incident 0.38 s · 14 records
    assignment_group.name=Network Ops^active=true^ORDERBYDESCpriority
    SIMILAR · incident running · 0.3 s
    short_descriptionLIKEvpn renegotiation^state=6

    A row you aren't allowed to see comes back as a 403 — your instance's access controls refusing, not a rule of ours. We wrote no authorization logic; there is none of ours to audit.

  4. KADDIYA
    It answers, and shows what the turn cost
    ≈ $0.011
    this turn, computed from these tokens at your model's price
    claude-sonnet-5 · in 1,842 · out 486 · cached 12,288

    Under every answer, while you work. Platform AI is metered in credits with no published price; this is a number in cents, from the same function the product uses to bill you nothing — you pay your model provider directly.

  5. PENDING
    If the answer implies a change, a card appears
    DRAFT REPLY pending your approval
    Hi Priya — we've identified the cause: the EMEA concentrator was dropping tunnels during key renegotiation. A firmware fix is applied and under monitoring now.
    Sends as you. Nothing is written until you press Send.Send

    The card shows the exact payload — not a summary of it, not a description of what it will do. What you read is what gets written.

  6. YOU
    You edit it, or you throw it away

    The body is editable in place. Discard and nothing was written — no draft queued anywhere, no record touched, nothing to clean up. This is the beat most products don't have.

  7. COMMITTED
    You press Send, and it is yours
    comments · INC0048291 · 2026-08-30 14:32:08 · approved and sent by dana.whitfield

    The commit runs on your credentials through one named endpoint, and lands in your instance's own audit tables under your name. Not "sent by an integration". Sent by you, because it was.

THE COMPLETE CATALOG
Fifteen tools. Twelve read, three propose, none write.

The agent cannot invent a capability. This is the entire list it can choose from, and it is short enough to read in a minute — which is the point, because a security reviewer should not have to take a vendor's word for what an agent can do. However many proposals come back in an afternoon, each one stops at the same place: a card, and a person.

Illustration: an overhead view of a person typing at a laptop, face unseen, with five composed cards arranged around the desk — Review KB article, Draft ready; Update workflow, Proposed changes; Respond to case, Ready for review; Analyze logs, Findings added; and Create task, Waiting for approval.
reads your instance9
  • sn_queryrecords matching an encoded query
  • sn_recordone record, in full
  • sn_aggregatecounts and groupings
  • sn_schemaa table's real fields and types
  • sn_list_tableswhat tables exist
  • sn_similarprior cases like this one
  • sn_my_workwhat is assigned to you
  • sn_update_setthe current update set
  • sn_update_set_contentswhat it has captured
reads the documentation2
  • sn_docs_searchServiceNow's docs for your release family
  • sn_docs_getone topic, cited in the answer
proposes a note to Kaddiya1
  • sn_note_savea gotcha about your instance, which a human keeps or discards before it is ever used again — and which never reaches ServiceNow
proposes an instance write8
  • sn_propose_replya comment or work note on one record
  • sn_propose_record_updateone task record's state, assignment, priority or resolution — shown before and after
  • sn_propose_approvalone approval you hold, approved or rejected
  • sn_propose_catalog_orderone catalog item, ordered with its variables filled
  • sn_propose_changeone change request — normal, emergency, or standard from a template
  • sn_propose_artifactone configuration record
  • sn_propose_artifact_updateone existing configuration record, shown before and after
  • sn_propose_update_setone update set

Anything you can do on your instance, it can draft — one record per card. Each of these returns a card and tells the model, in its own tool description, that it wrote nothing. The write happens later, if a human clicks, through the matching endpoint below — and not otherwise.

POST /api/record/commentSend, on a draft
POST /api/record/updateApply, on a proposed update
POST /api/approval/decideApprove or Reject, on a proposed decision
POST /api/catalog/orderOrder, on a proposed order
POST /api/change/createCreate, on a proposed change request
POST /api/artifact/createCreate, on a proposal
POST /api/artifact/updateApply, on a proposed change to an existing record
POST /api/update-set/createCreate, on a proposal
ONE MORE THING IT DOESN'T DO
It doesn't work while you're asleep, and that's deliberate.

There are no background jobs, no scheduled runs, and no agent sitting on a queue overnight. Kaddiya works while a human is watching it work — which is the only honest way to sell a product whose safety property is that a person approves every write.

The technical consequence is the part we'd rather you check: unattended operation would require us to hold a durable token to your production instance, long after you've closed the tab. We don't want to hold one, so we didn't build the thing that needs it. Your session ends, the token goes with it.

A background agent is not on the roadmap as a feature. It would be a different product, with a different security story.

What we holdWHILE YOU'RE SIGNED IN
Your tokensession only
After sign-outdiscarded
Background jobsnone
Offline agentsnone
Your model keyyours, not ours