George
George technical specification.
A plain reference for how George works: where he runs, which models he uses, how data is handled, who can do what, how changes are approved, and what he can and cannot do. Each row is one checkable fact. Items on the roadmap are labelled as roadmap.
Last reviewed 11 November 2026. Figures are stated in AUD where they are money.
At a glance
| Product | George, an AI colleague that works inside ServiceNow, from GlydePath Consulting Pty Ltd (Australia). |
|---|---|
| Platform | George is the agent runtime. LetGeorge is the multi-tenant platform beneath him. |
| Roles | Service desk analyst, catalog designer, CMDB manager, CSDM architect and ServiceNow developer. A customer can start with one role and add others. |
| How he works with ServiceNow | George runs as a separate service and reaches into the customer’s ServiceNow instance over OAuth. A governed REST API and a set of controls are installed in the instance. |
| Who decides | A person approves changes before they are saved. Builds go to development instances. |
| Production | In production George can look things up and propose plans for development work, but he does not change configuration. |
| Disclosure | George tells people he is an AI. |
| Pricing | Not published. A value estimate based on your own numbers is available on the George page. |
Hosting and data location
| Cloud provider | Amazon Web Services. |
|---|---|
| Region | Sydney (ap-southeast-2). |
| Region guard | An organisation-level AWS policy denies actions outside the Sydney and Melbourne regions. |
| Residency setting | Each customer organisation has a region setting. The default is ap-southeast-2. |
| Other geographies | Additional regions are on the roadmap. |
| Application services | Run on AWS Fargate (ARM), with two replicas of the request-path services, behind an Application Load Balancer protected by AWS WAF. |
| Web console | Served as static files from Amazon S3 and Amazon CloudFront. |
| Database | Amazon RDS for PostgreSQL, Multi-AZ, behind RDS Proxy, with the pgvector extension. |
| Availability | 99.5% availability target. |
| Recovery targets | Recovery point objective of 5 minutes and recovery time objective of 1 hour. |
| Backups | Retained for 35 days in production. |
| Files | Amazon S3, encrypted with AWS KMS, TLS-only access, public access blocked, stored under a per-tenant path. Files are private to their owner until shared. |
| Agent runs | Each turn runs as a durable workflow. An approval wait survives a closed browser and a restart. |
| Code execution | Runs in an isolated AWS Lambda sandbox with no route to the internet, as a non-root user with a minimal environment and no data permissions. |
| Document previews | Office documents are rendered in a separate, isolated service. |
| Infrastructure | Defined as code (OpenTofu). Deployments use short-lived credentials through GitHub OIDC. There are no static AWS access keys. |
| Secrets | Not stored in the code repository. Cloud secrets are held in AWS Secrets Manager. |
Models and AI providers
| Model access | Every model call goes through one model gateway, which is the single place for provider keys, cost limits and logging. |
|---|---|
| Providers supported | Anthropic Claude (directly and through Amazon Bedrock), OpenAI, Google Gemini, xAI and others, configured per organisation. |
| Claude | Reached through Amazon Bedrock in Sydney. |
| Image generation | Optional. OpenAI’s image models are used for images only, and only where an organisation opts in. An organisation that prefers can leave image generation off. |
| Bring your own key | An organisation can use its own provider key. Its spend is attributed to it, and it never falls back to the platform key. |
| Model prices | A model with no registered price is refused whenever cost limits are set. |
| Web search | Optional and provider-agnostic. The query leaves the platform, which is disclosed in the tool description, and an organisation can switch it off. |
| Training | George does not train models on customer data. Policy requires that providers offer no-training terms, checked at onboarding and each year. |
Data handling
| Data classes | Public, internal, confidential and restricted. Anything unclassified is treated as confidential. |
|---|---|
| What is stored | Conversations and messages, a run log (each model call, tool call, approval and guardrail step), audit records, skills, agent memory and files. |
| Tenant isolation | Enforced in the database with row-level security. Services connect as a role that cannot bypass it. A request with no tenant context returns no rows. |
| Isolation testing | Cross-tenant isolation tests are part of the definition of done. A failure is treated as the most serious incident level. |
| Encryption of secrets | Per-tenant envelope encryption: an AWS KMS-wrapped AES-256 data key for each tenant, with AES-256-GCM. It covers ServiceNow client secrets, users’ OAuth tokens and provider API keys. |
| Provider keys | Never readable back once stored. |
| Erasing a tenant’s secrets | Destroying the tenant’s wrapped key erases its encrypted fields. |
| Run log bodies | Purged after 30 days. |
| Run content | The full content of a run is visible to the person who ran it. |
| Blocked messages | A message is stored as sent, even when a guardrail blocks it. |
| Deleting a file | The file is hidden at once, then its bytes and derived copies are purged. A failed purge is retried by an hourly sweep. Deletion cannot be undone. A record of name, size, checksum and who remains. |
| Redaction | Optional per organisation, off by default. It covers three categories: card numbers, keys and passwords. It applies to tool results, replies and run steps. |
Identity and access
| Sign-in methods | Email and password, authenticator app (TOTP), passkeys, and Microsoft Entra single sign-on (single tenant). |
|---|---|
| Multi-factor | Required for every user and enforced for each session. After single sign-on, multi-factor is a platform setting that is on by default. |
| Session limits | Idle timeout defaults to 240 minutes. Absolute maximum defaults to 168 hours. Both can be changed. |
| Joining | By invitation only. A person with no invitation cannot join an organisation. |
| Authorisation | Central policy-as-code engine. Roles come from role assignments in a scope, and the active organisation is a field of the session. |
| Roles for chat users | A person using George in chat does not need a ServiceNow role. Their own-record access decides what they see. |
Control, approval and audit
| Kill switch | An organisation, an agent or a user can be disabled, which stops all activity. One platform setting stops everything. It is checked first on every tool call and fails closed. |
|---|---|
| Checks on every tool call | In order: kill state; classification (read, write, destructive or admin) against the maximum for that kind of work; allowed connection environments; production needs both the tool and the class to allow it; human approval, using the strictest of tool, toolset and class settings. |
| Tool availability | A tool is offered to an agent only if its toolset is attached and, for ServiceNow, a connection is selected and a grant exists on that connection. Other tools are absent from the model’s list. |
| Approvals | Bound to the tool, the requester and a SHA-256 hash of the arguments. Each approval is single use and expires after 1 hour, timing out closed. |
| Work modes | Ask (the default: a confirm card for every write), Plan (read-only, proposes a plan) and Auto within plan (writes that match an approved plan run without a card). Production offers only Ask and Plan. Deletes always ask. |
| Guardrails | Checkpoints on input, output, tool results and outbound requests. Built-in checks look for leaked secrets (blocking) and prompt-injection patterns (flagging). Every tool result is marked as external data, not instructions. |
| Skills George writes | Stay in draft until a person publishes them. |
| Cost caps | Daily caps per person, per service account and per organisation, plus a per-run ceiling that defaults to US$10. A cap blocks a turn at its start. |
| Audit log | Every tool decision, allowed or denied, is recorded with a snapshot of the limits in force. The audit log is append-only, with a per-tenant hash chain verified by a daily job. |
| Admin visibility | Administrators can see the structure of a run (step kinds, names, timings, tokens and cost). |
ServiceNow integration
| Credentials | Three kinds per connection. Service: OAuth client credentials with one integration user per connection. Per person: OAuth authorization code with PKCE, with the token checked to belong to the calling user. Delegated: a signed JWT bearer used for My Connections. |
|---|---|
| Chat acts as the person | Chat in the ServiceNow widget and in Teams runs on the signed-in person’s own credential, so ServiceNow access rules decide what is returned. No shared or elevated credential is used for data. |
| Development changes | Need an update set, and are refused in production. |
| Production | Only a limited set of operations can run in production, and none of them changes configuration. |
| Escalation controls | Controls against privilege escalation, and a dual audit trail (system log and the update set’s change log). |
| Password fields | Never returned to George. |
| Identity and scripts | George cannot repoint an OAuth user, rotate a secret or run background scripts. A person does that inside ServiceNow. |
| Environment tiers | Three standard tiers: development, UAT and production. A customer’s own labels are display only. Tagging or untagging production needs a platform admin, organisation admin or organisation owner and is audited. |
| Reaching UAT | A build reaches UAT only as an update set (load, preview, commit). Any other change to UAT is refused. |
| Catalog builds | Run one at a time. Autonomous work stays in development. Only a build with an empty review list may go to UAT. George never promotes stories. |
| Documentation lookups | The ServiceNow documentation tool takes the release as an input and uses the latest documented release by default. |
Roles and skills
| Service desk analyst | Works the queue as a loop of first reply, follow-up and close-out under an autonomous identity, with a master switch that is off by default. Priority 1 and 2 tickets, VIP callers, callers who cannot be emailed and test-looking records are excluded. Drafts knowledge articles from resolved tickets. |
|---|---|
| Catalog designer | Builds catalog items, flows and actions from versioned designs, compiled with the ServiceNow SDK, on development instances and delivered as update sets. |
| CMDB manager | Assesses health, finds duplicate, orphaned and stale items, reconciles, and designs CSDM models. |
| CSDM architect | Produces CSDM designs in a prototype workspace. Publishing a design into ServiceNow is optional and off by default. |
| ServiceNow developer | Plans and builds stories in development instances, with every change shown to a person for approval and saved in an update set. |
| Platform skills | Skills for ServiceNow administration, CSM, ITSM, ITOM, GRC, security operations, knowledge, reporting, software asset management, generative AI configuration, development and security. |
| How skills work | Skills are written as SKILL.md files and loaded as needed. An organisation can switch a platform skill off or replace it with its own. |
| Unattended catalog build | An approved catalog request item and a ServiceNow subflow can drive a build loop without a person at the keyboard. |
Channels
| Web console | An installable progressive web app with web push notifications. |
|---|---|
| ServiceNow portal widget | A chat widget with a floating launcher. Each chat is recorded as an interaction record and can be closed with a reason. |
| Microsoft Teams | One shared George bot. A customer’s Teams tenant is linked to its organisation by an administrator sign-in. People are matched by email address. Personal answers are refused in group chats. |
| ServiceNow queue | The ServiceNow integration queue calls an inbound gateway, protected by HMAC authenticity, idempotency and replay protection. |
| Data channel | A read-only lane for cost and instance data, with no agent involved. |
| Not a chat channel. Email is used only for system messages such as invitations, verification, password resets and notifications. | |
| Attachments | Supported in web and Teams chat, library-backed. |
Limits
| Upload size | Up to 25 MB per file. |
|---|---|
| Upload allowance | Defaults to 1,024 MB per person (a setting; 0 means unlimited). It counts uploads, not files George creates. |
| File types | An allow-list of documents, images, data and text files and a few media and archive types. Executables and scripts are excluded. The list is a setting. |
| Vision | By default 5 images and 10 scanned PDF pages per message, with upper limits of 20 and 50. |
| Approval wait | Up to 1 hour. |
| Run cost | A per-run ceiling that defaults to US$10. |
| Catalog builds | One at a time. |
| Rate limiting | Sign-in and password endpoints are rate limited. |
Compliance and subprocessors
| ISO/IEC 27001 | Certification to ISO/IEC 27001:2022 is on the roadmap for early 2027. |
|---|---|
| Further assurance | ISO/IEC 42001 and SOC 2 are on the roadmap for 2027. |
| Subprocessors | Approved in policy: Amazon Web Services, Anthropic, Cloudflare, Microsoft and GitHub. OpenAI is used only for optional image generation. A published subprocessor register is on the roadmap. |
What George does not do
| Production changes | George does not change configuration in production. |
|---|---|
| Approval | George does not approve his own changes. |
| Identity secrets | George cannot repoint an OAuth user or rotate a secret. |
| Existing CSDM records | When publishing a CSDM design, George writes only design-layer records, marked as created by George, and never changes existing records. |
| Promoting stories | George does not promote stories between environments. |
This specification was last reviewed on 11 November 2026.
More about George
George is a service from GlydePath Consulting Pty Ltd. ServiceNow and Now Assist are trademarks of ServiceNow, Inc. GlydePath is not affiliated with or endorsed by ServiceNow.