Platform Governance Framework Pattern…

advancedTested on Xanadu

The ServiceNow Platform Governance Framework Pattern establishes a comprehensive set of controls and processes to maintain code quality, security, and operational discipline across enterprise ServiceNow implementations. This pattern addresses the critical challenge of managing multiple developers, complex customizations, and regulatory compliance requirements that emerge in large-scale ServiceNow deployments.

The framework integrates automated code quality checks, mandatory review processes, update set lifecycle management, and change advisory board workflows into a cohesive governance system. It enforces development standards through business rules and script includes that validate customizations before deployment, while providing visibility into compliance metrics and audit trails. The pattern ensures that all platform changes follow established procedures and meet quality standards before reaching production environments.

Chrome Extension

Sourdough: ServiceNow Monitoring and Analytics

A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.

Instance HealthGraphs & ChartsAPI HealthDeveloper ToolsQuick SearchInstance Switcher

Add to Chrome

Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.

Overview

Tasks

CMDB

API

Metrics

Monitor

Internals

Instance:sourdoughdev·Version:Yokohama

Instance StateONLINE

System StatusFully Operational

Session Timeout90 minutes

Logged-In Sessions2 (20 active)

Build Nameyokohama-12-18-2024_p1

IP Address10.159.128.43

Instance HealthHealth Score: 90%

🔥 5dSourdough (Chrome Plugin)Dark Mode

Use This When

Use this pattern when managing enterprise ServiceNow instances with multiple developers, regulatory compliance requirements, or complex change management processes. It's essential for organizations that need to maintain strict code quality standards, require audit trails for all platform changes, or integrate ServiceNow development with existing IT governance frameworks.

Avoid When

Avoid this pattern for small teams with simple implementations or proof-of-concept environments where development speed is prioritized over governance. The overhead of mandatory reviews and validation processes can significantly slow development velocity and may be counterproductive for agile development environments or when rapid prototyping is required.

Implementation

Server-side

var GovernanceFramework = Class.create();
GovernanceFramework.prototype = {
    initialize: function() {
        this.GOVERNANCE_TABLE = 'u_governance_tracking';
        this.VIOLATION_TABLE = 'u_governance_violations';
    },
    
    validateUpdateSet: function(updateSetSysId) {
        var violations = [];
        var updateSet = new GlideRecord('sys_update_set');
        if (!updateSet.get(updateSetSysId)) {
            return { valid: false, errors: ['Update set not found'] };
        }
        
        // Check naming convention
        if (!this._validateNamingConvention(updateSet.name.toString())) {
            violations.push('Update set name does not follow naming convention: [STORY-####]_Description_YYYY-MM-DD');
        }
        
        // Validate code quality in update set
        var updates = new GlideRecord('sys_update_xml');
        updates.addQuery('update_set', updateSetSysId);
        updates.query();
        
        while (updates.next()) {
            var codeViolations = this._validateCodeQuality(updates);
            violations = violations.concat(codeViolations);
        }
        
        // Record governance tracking
        this._recordGovernanceEvent(updateSetSysId, 'validation', violations.length === 0 ? 'passed' : 'failed', violations);
        
        return {
            valid: violations.length === 0,
            violations: violations,
            updateSet: updateSet.name.toString()
        };
    },
    
    enforceCodeReviewGate: function(updateSetSysId, reviewerSysId) {
        var review = new GlideRecord('u_code_reviews');
        review.initialize();
        review.update_set = updateSetSysId;
        review.reviewer = reviewerSysId;
        review.status = 'pending';
        review.created_date = new GlideDateTime();
        var reviewId = review.insert();
        
        // Send notification to reviewer
        this._sendReviewNotification(reviewerSysId, updateSetSysId);
        
        // Block update set progression
        this._setUpdateSetState(updateSetSysId, 'under_review');
        
        return reviewId;
    },
    
    createCABRequest: function(updateSetSysId, implementationDate) {
        var cabRequest = new GlideRecord('change_request');
        cabRequest.initialize();
        cabRequest.type = 'normal';
        cabRequest.category = 'software';
        cabRequest.subcategory = 'servicenow_platform';
        cabRequest.short_description = 'ServiceNow Platform Change - ' + this._getUpdateSetName(updateSetSysId);
        cabRequest.implementation_plan = this._generateImplementationPlan(updateSetSysId);
        cabRequest.risk_impact_analysis = this._generateRiskAnalysis(updateSetSysId);
        cabRequest.requested_by = gs.getUserID();
        cabRequest.planned_start_date = implementationDate;
        cabRequest.state = '1'; // New
        
        var changeId = cabRequest.insert();
        
        // Link update set to change request
        this._linkUpdateSetToChange(updateSetSysId, changeId);
        
        return changeId;
    },
    
    _validateNamingConvention: function(name) {
        var pattern = /^\[\w+-\d+\]_[\w\s]+_\d{4}-\d{2}-\d{2}$/;
        return pattern.test(name);
    },
    
    _validateCodeQuality: function(updateRecord) {
        var violations = [];
        var payload = updateRecord.payload.toString();
        
        // Check for hardcoded sys_ids
        if (payload.match(/[0-9a-f]{32}/g)) {
            violations.push('Hardcoded sys_ids detected in ' + updateRecord.name);
        }
        
        // Check for direct table manipulation without proper API
        if (payload.includes('executeUpdate()') && !payload.includes('setWorkflow(false)')) {
            violations.push('Direct database updates without workflow consideration in ' + updateRecord.name);
        }
        
        // Validate script includes have proper error handling
        if (updateRecord.name.startsWith('sys_script_include') && !payload.includes('try')) {
            violations.push('Script Include missing error handling: ' + updateRecord.name);
        }
        
        return violations;
    },
    
    _recordGovernanceEvent: function(updateSetId, eventType, status, details) {
        var tracking = new GlideRecord(this.GOVERNANCE_TABLE);
        tracking.initialize();
        tracking.update_set = updateSetId;
        tracking.event_type = eventType;
        tracking.status = status;
        tracking.details = JSON.stringify(details);
        tracking.timestamp = new GlideDateTime();
        tracking.insert();
    },
    
    generateComplianceReport: function(startDate, endDate) {
        var report = {
            totalUpdateSets: 0,
            validationPass: 0,
            reviewCompliance: 0,
            cabCompliance: 0
        };
        
        var tracking = new GlideAggregate(this.GOVERNANCE_TABLE);
        tracking.addQuery('timestamp', '>=', startDate);
        tracking.addQuery('timestamp', '<=', endDate);
        tracking.addAggregate('COUNT');
        tracking.groupBy('status');
        tracking.query();
        
        while (tracking.next()) {
            var status = tracking.status.toString();
            var count = parseInt(tracking.getAggregate('COUNT'));
            
            if (status === 'passed') {
                report.validationPass += count;
            }
            report.totalUpdateSets += count;
        }
        
        return report;
    },
    
    type: 'GovernanceFramework'
};

Client-side

// Governance UI Policy for Update Set Management
function onLoad() {
    // Hide promote button until governance checks pass
    var updateSetId = g_form.getUniqueValue();
    
    var ga = new GlideAjax('GovernanceFramework');
    ga.addParam('sysparm_name', 'validateUpdateSet');
    ga.addParam('sysparm_update_set_id', updateSetId);
    ga.getXMLAnswer(function(response) {
        var result = JSON.parse(response);
        
        if (!result.valid) {
            // Display violations
            g_form.showFieldMsg('state', 'Governance violations detected: ' + result.violations.join(', '), 'error');
            
            // Hide promote actions
            g_form.setDisplay('u_promote_button', false);
        } else {
            g_form.showFieldMsg('state', 'Governance validation passed', 'info');
        }
    });
}

function requestCodeReview() {
    var updateSetId = g_form.getUniqueValue();
    var reviewerDialog = new GlideModal('code_reviewer_selection');
    reviewerDialog.on('reviewerSelected', function(reviewer) {
        var ga = new GlideAjax('GovernanceFramework');
        ga.addParam('sysparm_name', 'enforceCodeReviewGate');
        ga.addParam('sysparm_update_set_id', updateSetId);
        ga.addParam('sysparm_reviewer_id', reviewer);
        ga.getXMLAnswer(function(response) {
            g_form.addInfoMessage('Code review request submitted');
            g_form.reload();
        });
    });
    reviewerDialog.render();
}

The server-side code implements a comprehensive governance framework with validation methods for update sets, automated code quality checks, and CAB integration. The client-side code provides UI enforcement by hiding promotion buttons until governance requirements are met and enables reviewer selection through modal dialogs. Key features include naming convention validation, hardcoded sys_id detection, and compliance reporting with audit trails.

Alternatives

Lightweight Standards Enforcement

Uses only business rules and data policies to enforce basic standards without complex workflow integration. Faster to implement and maintain but provides less comprehensive governance and limited audit capabilities for enterprise environments.

External CI/CD Pipeline Governance

Integrates ServiceNow with external tools like Jenkins or Azure DevOps for governance enforcement outside the platform. Provides more sophisticated tooling and integration options but requires additional infrastructure and expertise in external tools.

Manual Process with Documentation

Relies on documented procedures and manual checkpoints rather than automated enforcement. Reduces development overhead and system complexity but depends heavily on human discipline and provides poor audit trails for compliance requirements.

Test Your Knowledge

Quick 3-question quiz — see how your ServiceNow skills stack up.

Question 1 of 3Performance

A list view on a table with millions of records is slow. Best fix?

Select an answer to continue