Every Now Assist agent action,
independently judged before it executes.

// Flow action "Veridect pre-action" — step 1 of any tool an AI agent can call
(function execute(inputs, outputs) {
  outputs.proceed = false; outputs.verdict = 'unavailable'; outputs.record_id = '';   // closed until proven open
  var agentId = gs.getUserID();                          // the identity this action runs as (the agent's service account) — never an input the agent fills in
  var auth = new GlideRecord('x_veridect_agent_authority');   // your table: one row per agent identity, its authority in words
  if (!auth.get('agent_user', agentId)) { outputs.verdict = 'unknown_agent'; return; }   // no configured authority: never asked, never run
  var d = null;
  try {
    var r = new sn_ws.RESTMessageV2('Veridect', 'pre-action');   // REST Message record: endpoint + credential alias live there, not in code
    r.setHttpTimeout(60000);
    r.setRequestHeader('Content-Type', 'application/json');
    r.setRequestBody(JSON.stringify({
      action:            inputs.action,                  // e.g. "reassign_incident"
      target:            'servicenow:' + inputs.table,   // e.g. "servicenow:incident"
      parameters:        JSON.parse(inputs.parameters_json),   // a bad payload throws here — inside the fail-closed try
      callingAgent:      String(auth.getValue('agent_name')),
      callingAgentScope: String(auth.getValue('scope')),      // its configured authority, in words
      department:        String(auth.getValue('department'))
    }));
    var resp = r.execute();                            // synchronous — the step waits for the verdict
    if (resp.getStatusCode() === 200) d = JSON.parse(resp.getBody());
  } catch (e) { d = null; }                            // network, timeout, parse: all stay closed
  if (d && d.verdict) {
    outputs.verdict   = d.verdict;
    outputs.record_id = d.auditBundleId || '';
    outputs.proceed   = d.verdict === 'greenlight';   // step 2 (the work) runs only if true
  }
})(inputs, outputs);

// Before Business Rule · insert, update · on each governed table
// Condition: gs.getUser().isMemberOf('Veridect AI Agents')   ← marker group holding the identities your agents run as (a role would also match admins)
(function executeRule(current, previous) {
  var changed = {}, fields = current.getFields();
  for (var i = 0; i < fields.size(); i++) {
    var el = fields.get(i);
    if (el.changes()) changed[el.getName()] = String(el);
  }
  var d = null;
  try {
    d = new x_veridect.Gate().preAction({              // your Script Include around the same POST as Path 01
      action:            (current.isNewRecord() ? 'create_' : 'update_') + current.getTableName(),
      target:            'servicenow:' + current.getTableName(),
      parameters:        changed,
      callingAgent:      gs.getUserName(),              // the identity the agent runs as — platform context, not a field on the record
      callingAgentScope: new x_veridect.Gate().scopeFor(gs.getUserID()),   // looked up by the stable user sys_id in x_veridect_agent_authority; null → no verdict → abort
      department:        gs.getProperty('x_veridect.department')
    });
  } catch (e) { d = null; }                            // unreachable or malformed → treated as no verdict
  if (!d || d.verdict !== 'greenlight') {
    gs.addErrorMessage('Not written — Veridect ' + (d ? d.verdict + ' (record ' + d.auditBundleId + ')' : 'unavailable'));
    current.setAbortAction(true);                      // the write never happens; the refusal is on the ledger
  }
})(current, previous);

# 1) once — register the tool server as an upstream (admin call)
POST /api/ai/consensus/mcp/upstreams/{tenant}
{ "upstreamId": "fabric-tools-prod",
  "url": "https://<your-tool-server>/mcp",
  "enabled": true }

# 2) the MCP connection AI Agent Fabric uses — before
MCP_URL = "https://<your-tool-server>/mcp"

# 2) the MCP connection AI Agent Fabric uses — after
MCP_URL = "https://<your-veridect-host>/api/mcp/gateway/fabric-tools-prod"
HEADERS = {
  "Authorization":            "Bearer <VERIDECT_API_KEY>",      # your Veridect tenant
  "X-Upstream-Authorization": "Bearer <tool-server token>",    # forwarded to the tool server as Authorization
}

# 3) what the agent sees on a greenlight: the upstream's own result, plus
#    result._meta["veridect/verdict"] and result._meta["veridect/bundleId"]
#    on escalate / block: a JSON-RPC error (-32003 / -32004) carrying the
#    verdict and the record id — and the tool server never receives the call.

// what Veridect sends your instance — the Table API call every instance accepts
POST https://<your-instance>.service-now.com/api/now/table/incident
{
  "short_description": "[Veridect] AI serious-incident package — escalate decision qai-act-…",
  "description":  "<the package's disclosure, verbatim>
                   Decision bundle: qai-act-…  |  Verdict: escalate  |  Risk tier: high
                   Policy classes: dollar_threshold
                   Payload SHA-256: 9f3c…  — re-derive via the incident-payload API",
  "work_notes":   "veridect.incident-payload.v1 | sha256=9f3c…
                   { \"schema\": \"veridect.incident-payload.v1\", \"event\": {…}, \"trigger\": {…},
                     \"measures\": {…}, \"evidence\": {…}, \"verification\": {…} }",
  "urgency": "2", "impact": "2"
}

// the instance answers with the record it created — number and sys_id —
// and that is what Live 04 shows you below, straight from ServiceNow's reply.