Moveworks

Verdict

Shortlist Moveworks when the buying job is broader than finding documents: employees need one conversational entry point to search company knowledge, submit requests, approve work, and trigger governed actions across IT, HR, identity, and collaboration systems. Its strongest case is a large organization willing to treat retrieval, action permissions, and connector operations as an owned platform.

Do not buy it as a generic chatbot or approve it from a polished cross-app demo. The decision turns on two separate tests: whether each connector returns the right current content to the right employee, and whether every write action executes under the intended identity with the intended approval. Moveworks documents multiple search journeys and multiple access-control strategies; behavior is connector- and workflow-specific.

Compare it with Glean when retrieval is the primary job, or Guru when maintained, verified knowledge matters more than broad action coverage. The workplace-search shortlist covers the wider category.

Decision snapshot

Search and action are the reason to consider it

Moveworks exposes enterprise search in two forms: a dedicated search application in My Moveworks and a conversational plugin inside the AI Assistant. Both use the same connector and retrieval foundation. The dedicated surface favors ranked results and filters; the assistant can synthesize results and then invoke other plugins in the same conversation.

That combination matters when an employee starts with “What is the parental-leave policy?” and continues into a request or approval. It matters less if the real requirement is a neutral search box over a small, stable document set. For the latter, implementation and governance overhead may outweigh the action layer.

Before procurement, define five representative employee journeys. Include a known-item lookup, a cross-source answer, a restricted document, a recently changed policy, and a write action with an approval. Score retrieval and execution separately. A fluent answer over stale content is a search failure; a correct answer followed by an over-privileged API call is an access-control failure.

Connector scale has exact boundaries

Checked October 25, 2026. The current connector documentation separates two ingestion journeys:

The nine Max Capacity systems are Box, Confluence Cloud, Google Drive, Outlook, ServiceNow, SharePoint Online and OneDrive, Slack, Unily, and Zendesk. Other supported systems use Classic. A missing native connector requires a request to Moveworks or a custom Content Gateway integration.

Max Capacity is not automatically a strict superset. Its current scope controls work at levels such as site, space, knowledge base, drive, folder, or category, but the docs say finer controls including SharePoint library- or folder-level scoping, Confluence CQL, and ServiceNow query and article-type rules are not yet supported there. Existing Classic designs that depend on those filters need a migration review. The setup guide also says to wait at least 18–24 hours after saving before testing an initial ingestion; that is rollout guidance, not a general freshness SLA.

Permissions need two acceptance plans

For indexed search, Moveworks documents mirrored relationship rules, managed attribute rules, organization-wide public or denied content, and connector-specific support. Live Search can call the source with a user's OAuth token. Ask the vendor to label the actual strategy for every source instead of accepting a platform-level claim that permissions are respected.

Actions add another layer. The end-user access guide lists three approaches: execute through source authentication such as JWT or OAuth, implement record checks inside the customer API, or limit plugin launch through Moveworks rules. These controls answer different questions. Launch eligibility does not prove that a shared connector limits which records an employee can read or change.

Developer permissions are separate again. Connectors are closed to their creator and admins by default under the newer Tool Studio access controls, and execution requires access through the dependency chain. Confirm those controls and roles are enabled in the quoted workspace.

Run negative tests with ordinary users, developers, operators, and admins. Include a revoked group membership, an HR-only record, a plugin visible to the wrong department, a shared credential, and an approval that changed in the system of record before the employee clicked it.

Pricing is quote-only

Moveworks' pricing page asks buyers to request a custom quote and describes flexible packages. It does not publish a dollar price, billing unit, minimum employee count, included connector quantity, implementation charge, usage allowance, or overage rate. Third-party contract estimates are not a current rate card and are excluded here.

Require the order form to identify:

• the licensed employee population and any minimum commitment;
• whether Enterprise Search, the dedicated search app, AI Assistant, Tool Studio, and Productivity Boost are included;
• Classic and Max Capacity connector entitlements plus custom integration services;
• model, agent, workflow, or “assist” usage meters and overage treatment;
• implementation, migration, support, sandbox, and renewal costs;
• whether the purchase is a standalone Moveworks subscription or a ServiceNow/EmployeeWorks entitlement.

ServiceNow completed its acquisition of Moveworks on December 15, 2025. That ownership is verified; it does not establish what a particular ServiceNow agreement includes. Reconcile the quote with the buyer's existing ServiceNow products rather than inferring entitlement from an app-store listing or product name.

Privacy claims apply to different data stores

The Quick GPT documentation says employee inputs are not used to train global models and that OpenAI and Azure OpenAI apply zero-day retention for that feature. This is a model-provider statement, not a promise that Moveworks keeps no conversation or analytics data.

Moveworks' own AI Assistant Insights documentation says the dashboard has no default retention policy and can expose conversation data from the organization's launch. Treat user-visible conversation history, analytics and exports as separate stores and access paths. Ask for the contractual deletion schedule, regional processing path, support-access model, export behavior, and the exact roles that can replay employee conversations.

The current subprocessor list, checked October 25, 2026, names AWS, Microsoft, OpenAI, Snowflake, Cloudinary, Datadog, and Google among providers used for US hosting, with region-specific differences. Security review should map the selected deployment region and enabled features to the applicable rows rather than assuming every provider handles every request.

Community evidence: broad front door, real implementation edges

In an October 2026 r/servicenow discussion, Ruens719 reported an implementation that surfaced knowledge from SharePoint, ServiceNow, and Workday, supported approvals, linked into live help, and embedded the assistant in an EMR help page. In the same thread, Pineblaster described a different catalog-item implementation as constrained by unsupported client scripts, some field types, and finicky requirements. EarthShakerFirst recalled similar limits in an older pre-acquisition deployment.

These are attributed practitioner accounts, not verified benchmarks, and the reported implementations may target different product generations. They support a practical conclusion: the front door can span useful employee jobs, while workflow fidelity still depends on the exact form, script, field, connector, and handoff. Put the hardest existing service-catalog item into the pilot; do not test only password resets and polished knowledge queries.

Rollout gate

Start with one employee population and a small corpus whose owners can inspect failures. Capture the expected source, access result, freshness, citations, action identity, approval path, and final system-of-record state for every test. Add a no-answer case and a denied-action case. Expand only when owners can explain both false answers and failed writes, security can account for every conversation store, and finance can reconcile the quote to observed usage.

For implementation detail, use How to Search Company Knowledge With AI, How to Answer Questions Across Slack, Drive and Notion, and How to Build an Internal AI Knowledge Base That Stays Current. This profile is source-based research reviewed October 25, 2026; the images are vendor examples, and no retrieval, permission, latency, or action benchmark was run.

Sources & further reading

• Moveworks Enterprise Search product and vendor interface examples
• Enterprise Search application and plugin overview
• Search connector journeys, limits, and availability
• Max Capacity setup and known limitations
• Indexed and live search permission strategies
• End-user access control for action plugins
• Tool Studio connector access controls
• Moveworks custom-quote pricing page
• Quick GPT model retention and training statement
• AI Assistant Insights conversation retention
• Current Moveworks hosting subprocessors
• ServiceNow acquisition completion announcement
• 2026 practitioner implementation discussion on Reddit