From Demo to Production: The Virtual Agent Architecture Demos Never Show You

The Scenario

You've built a proof-of-concept Virtual Agent that wows in demos—users ask for a password reset, it flows perfectly, ticket created. Then production hits: executives complain about escalation loops, IT ops see NLU confidence scores in the toilet, and security audits flag exposed catalog items. The demos skipped the ACL scaffolding, topic governance, and telemetry that make this scale to 10K daily conversations.

As a ServiceNow developer, you're not asking for basic setup—you want the production hardening that official docs gloss over: how topics chain without breaking, how to ACL-guard scripted actions, and the monitoring that catches 80% containment dropping to 30%.

Key Questions Answered

Q: What's the technical architecture I need to build?

A: Think microservices orchestration: NLU Model (intent/entity recognition) → Topic Blocks (conversational FSM) → Scripted Actions ( GlideRecord ops ) → Integration Spokes (external APIs). Core is the Conversational Interfaces layer: topics live in the sys_cs_topic table, with topic blocks, scripts, and conversation context persisted in related sys_cs_* tables. Demos show one topic; production needs 50+ governed by blocks, with Now Assist for dynamic routing. Security wrapper: ACLs on va_context and sys_attachment for audit trails.

Q: What are the step-by-step implementation phases?

A: Phase 1: Plugins & Guided Setup (activate Glide Virtual Agent, ITSM VA, NLU Workbench). Phase 2: Portal Integration (add VA widget to ESS SP). Phase 3: Topic Factory (duplicate OOTB, build blocks for reuse). Phase 4: NLU Training (import content packs, train intents). Phase 5: Handoff Config (Agent Chat routing). Phase 6: Telemetry (Recommendation Settings for containment tracking). Skip guided setup survey—it's marketing; hit plugins directly.

Q: How do I handle security, ACLs, and data access?

A: VA runs as portal user context—default ACLs expose everything. Create va_ prefixed roles (va_user, va_admin). On your topic script actions, enforce ACLs: require va_user AND script conditions that check gs.getUser().hasRole('itil'). For catalog actions, wrap in Script Include with queryBusinessRules=false. Audit via sys_audit on va_conversation. Pro tip: Use Context Variables to impersonate without full elev privs.

Q: What testing strategy ensures quality?

A: Unit: VA Designer test runs (100 utterances/topic). Integration: Load test with 100 concurrent via CI Test page. NLU: Train/test split in NLU Workbench (aim 85% confidence). E2E: Scripted portal tests with ATF, simulating multi-turn fails. Production sim: Enable debug logging, reproduce in sub-prod clone. Metric: 75% containment before launch.

Q: How do I monitor and improve over time?

A: sys_va_conversation_view for raw logs. Build PA dashboard: containment %, avg turns, escalation rate. Recommendation Settings auto-trains on failures. Weekly: Export CSV, retrain NLU on low-confidence paths. Alert on <70% containment via Event Management. Now Assist analytics track topic drift—retrain quarterly.

Q: What production issues should I anticipate?

A: NLU hallucination (fix: intent thresholds >0.8). Context loss on refresh (fix: persistent va_context sys_id). Multi-language fails (fix: locale-specific models). Handoff drops (fix: preserve context in interaction_to_agent). Scale: 1K+ convos spike CPU (fix: async Script Includes).

The Translation Map

Your developer mental model maps directly—here's the ServiceNow equivalent:

Your World	ServiceNow VA Equivalent	Key Diff
API Gateway + Lambda	NLU → Topic Executor	Stateful sessions vs stateless
Intent Classifier (Dialogflow)	NLU Workbench Intents	ServiceNow trains on platform data
Database Queries	GlideRecord in Script Steps	ACL-enforced, no raw SQL
Session Store (Redis)	va_context table	Auto-pruned after 24h
Monitoring (Datadog)	PA Dashboards + sys_va_metrics	Built-in, no agents needed

Hands-On: See It Work

// Production-Ready Password Reset Topic Block
// Equivalent: Your API endpoint with auth + DB update

var userEmail = vaVariables.email; // Captured from NLU entity

var gr = new GlideRecord('sys_user');
gr.addQuery('email', userEmail);
gr.query();

if (gr.next()) {
    // ACL-safe: Runs as portal user, query respects roles
    if (!gr.canRead()) {
        vaVars.error = 'Access denied to user data.';
        vaVars.message = 'Cannot access your account. Contact HR.';
        return;
    }
    
    // Generate temp password (your bcrypt equiv)
    // Trigger the platform's built-in password reset mechanism
    // Never store passwords in custom fields or use base64 (not encryption)
    var pwdReset = new GlideRecord('pwd_reset_request');
    pwdReset.initialize();
    pwdReset.user = gr.sys_id;
    pwdReset.insert();
    
    // Notify via email (your SES integration)
    gs.eventQueue('user.password.reset', gr, userEmail, gs.getUserID());
    
    vaVars.success = true;
    vaVars.message = 'New password sent to ' + userEmail + '. Login at /sp.';
    
} else {
    vaVars.error = 'No account found for that email address.';
    vaVars.success = false;
}

// Context persistence for handoff (your session handoff)
vaVars.reset_user_sys_id = gr.getUniqueValue();

// Logging for telemetry (your structured logs)
gs.info('VA Password Reset: ' + userEmail + ' | Success: ' + vaVars.success);

This Script Step goes in a "Reset Password" topic's Action block. It captures email from NLU, ACL-checks the query, generates/sets temp pass, queues email, and persists context. Test in VA Designer: Type "reset my password" → enter email → see success. In production, monitor via sys_va_conversation for 'success=true' rate. Screenshot desc: VA Designer shows topic flow—NLU Intent → Capture Email Block → Script Include → Success Cards or Handoff.

What Transfers vs What's Different

Transfers directly: Your scripting (JS), API patterns (query/update/notify), state management. GlideRecord feels like ORM you'd build. NLU training mirrors ML model fine-tuning.

Requires new learning: ACL model (role-based table access)—no SQL bypass. Topic Blocks (visual FSM)—not pure code. va_context lifecycle (auto-expires). Platform events over webhooks. 2-week ramp for seniors.

The Business Impact

75% containment slashes L1 tickets by 40%, freeing IT for strategic work—over a million in annual savings at scale. Executives get 24/7 self-service, reducing MTTR from 4h to 2m. Ties to SLA compliance: VA resolutions count as fulfilled, boosting CSAT 15pts. Scales without headcount—handle Black Friday spikes autonomously.

Common Traps to Avoid

• Trap: Building 100 custom topics from scratch. Solution: Duplicate OOTB ITSM pack, customize 20%—saves 80% effort.
• Trap: Ignoring NLU training data. Solution: Import content packs weekly; retrain on prod logs.
• Trap: No context in agent handoff. Solution: vaContext.putVar() before routing—agents see full transcript.
• Trap: Testing only happy paths. Solution: ATF for edge cases (invalid email, ACL deny).
• Trap: Forgetting mobile/SP widget. Solution: Add 'VA Chat' widget to ESS portal page.

Your Next Steps

• Activate plugins: Navigate Plugins → search 'Glide Virtual Agent' → Install now.
• Run Guided Setup: Conversational Interfaces → Get Started → Complete plugin tasks.
• Build first topic: VA Designer → Duplicate 'Check my request' → Add the password script above → Publish.
• Test E2E: Service Portal → Start chat → "reset password" → Validate ticket/email.
• Monitor Day 1: sys_va_conversation_view → Filter your sys_id → Check containment.

Deploy this pattern across HR/ITSM, and you'll hit production readiness official docs never detail.