From test case to control tower: How DXC and ServiceNow are governing enterprise AI at scale

As autonomous agents start approving expenses and steering warehouse robots, the real risk is absent guardrails.

Today, the industry is seeing AI agents approving expenses, routing support tickets, and optimising supply chains with minimal human oversight. They’re operating robots in warehouses and autonomous vehicles in logistics hubs. When they fail, it's rarely because they've gone rogue. According to Ng See Sing, Managing Director of DXC Singapore, it is because deployments were often done as fast as possible, with governance as an afterthought.

For organisations across APAC, particularly in Singapore's highly regulated and digitally mature market, the stakes are even higher.

When DXC deployed ServiceNow's Core Business Suite as Customer Zero, the company learned what “ready” really means – and it's not what most governance frameworks assume.

Control gaps become problematic when machines can move. This isn't Terminator. It's Tuesday. Most organisations aren't ready for it.

Physical AI overwhelms traditional enterprise controls in ways software never did. Decisions happen in milliseconds – faster than any approval workflow. Real-time sensors feeding enterprise systems mean tiny errors compound fast. Machines don’t just follow rules; they adapt on the fly. Today, security teams must manage risks that span both digital systems and physical operations.

The real risk isn't operational; it's strategic. As AI agents optimise processes at speed, they can uncover patterns and improvements that quickly become a source of competitive advantage. But if your governance layer lives entirely on someone else's platform, that knowledge accumulates there – not in your business. In the agentic era, governance isn't just compliance. It's intellectual property.

Building governance that works

DXC took a different approach. It made itself the test case. As “Customer Zero” for ServiceNow's Core Business Suite, the company deployed it across its own global operations first, putting AI agents to work internally before taking the governance framework to clients. Governance at enterprise scale needs proof, not promises.

What DXC built is an Agentic Control Tower—a governance framework sitting on top of ServiceNow's AI Control Tower platform. Five layers that counter the risks: every agent gets an identity and policy boundary. Security and compliance are baked into deployment workflows. Autonomy gets tested in digital twins before touching live operations. Multi-agent coordination happens through governed handoffs with fail-safes that are built in, not bolted on, and data access is controlled at the source with full audit trails.

ServiceNow provides the platform foundation: workflow governance, agent lifecycle management, and policy enforcement. DXC orchestrates across the entire technology estate, making sure the control tower works with SAP, Oracle, and whatever else companies already own. This isn’t about buying another platform. It’s about governing the ones you already have differently.

Three questions that matter

If you're working out your AI governance approach, three questions cut through the noise.

First: Who actually owns your control plane? If it sits solely with IT, you've got a technology team governing business capability. If the vendor owns it, you've handed over the keys. Control plane ownership needs to be cross-functional with board visibility.

Second: Where does the institutional knowledge go? When agents learn and optimise, that intelligence needs to stay with your business. If it's trapped in vendor models, you get weaker every time you switch platforms.

Third: What are you actually measuring? Cost savings alone aren’t enough. You need the full picture – risk reduction, compliance posture, decision quality, and speed to insight. Efficiency gains don't matter if governance gaps create liabilities that outweigh them.

Singapore's Model AI Governance Framework has become the regional standard for a reason. It is practical without being prescriptive. With the National AI Strategy 2.0 pushing trustworthy deployment, companies that build proper governance now won't be caught flat-footed when regulation inevitably tightens.

DXC deployed the Agentic Control Tower internally first because it needed to know it works at scale. That hands-on experience is now helping clients deploy governed AI with confidence, whether it's a workflow approving purchase orders or a robot navigating a warehouse.

The companies that win in the agentic era will be the ones who build autonomy on top of discipline, ownership, and trust. DXC and ServiceNow aren't just talking about it. They’re proving it works.