ServiceNow gives every AI agent a signed passport. What counts is who checks it at the door
ServiceNow's AI Passport, due in Q4 2026, turns an agent's authorized scope into a signed credential checked at runtime. The value depends on enforcement points the agent cannot bypass.
Listen to this article · 6 min
AI-generated narration of the full article.
Ask a third-party agent what it is allowed to do and it will tell you. That answer is worth exactly as much as the agent’s honesty and the integrity of its prompt, which is to say not much in a production workflow where the agent reads documents, emails and tool results written by people you have never met.
ServiceNow’s AI Passport, announced on October 15, is built around that problem. Each agent receives a cryptographically signed credential, issued by ServiceNow’s Super Intelligence Control Tower, that states its authorized scope. The scope is grounded in the CMDB, GRC policies and workflow approvals, and agents present the credential at runtime, in environments such as NVIDIA’s OpenShell. ServiceNow’s own phrase for third-party agents is the important one: a verifiable permissions record “rather than relying on the AI agent’s own ‘claims’ about its permissions.”
AI Passport, together with shadow AI detection and AI Cost Management, is expected in Q4 2026. The Operational Resilience solution for financial services, announced the same day, is available now.
A credential is a claim that can be checked
A signed passport changes the question from “what does the agent say it may do?” to “what did the enterprise sign that it may do?” Three features in the announcement matter more than the cryptography:
- Scoped delegation that narrows at each step. When an agent hands work to another agent, the second one should never inherit more than the first held. ServiceNow says delegation narrows step by step in multi-agent workflows. That is the property most homegrown agent chains lack today.
- Precise revocation. A credential that can be withdrawn for one agent, one scope, without redeploying anything, is what makes an incident plan executable.
- Graduated responses. When an agent drifts out of scope, ServiceNow describes redirecting, restricting or reconnecting it with proper context, with a kill switch as the last step.
The checkpoint is the product
A passport stops nothing by itself. Somebody has to inspect it at the point where an action happens: the tool gateway, the runtime, the API in front of the system of record. If the agent can reach a tool without passing a checkpoint that verifies the credential, the passport is documentation.
ServiceNow appears to know this. NVIDIA is the design and launch partner, and ServiceNow says it is building “a production-ready enforcement implementation” on NVIDIA’s Open Agent Safety Platform, with the OpenShell runtime and the Sentry security framework. NVIDIA’s quote puts it plainly: securing agents “demands enforcement at the infrastructure layer.” That implementation is announced work, not a shipped product, and the rest of your estate will not run on OpenShell.
Who issues, who carries, who checks
Issuer
- Control Tower signs the scope
- Grounded in CMDB, GRC and approvals
- Revokes per agent
Agent
- Carries the passport
- Hands narrower scope to sub-agents
Enforcement point
- Runtime or tool gateway
- Verifies signature and scope
- Blocks, restricts or stops
This is the separation we described in six independent authorities over an agent: the party that decides scope and the party that enforces it should be different, and enforcement has to live outside the agent. AI Passport formalizes the first half. The second half depends on what sits in your traffic path.
Open specifications, open questions
ServiceNow says AI Passport is built on open specifications, so that “any governance product, identity provider, or enforcement point” can issue and verify credentials. That is the right ambition for a multi-vendor estate, and it should be tested before it is assumed. The announcement does not name the specifications, and an open format does not guarantee that your agent frameworks, gateways and identity provider will verify it.
Questions worth putting to ServiceNow, or to any vendor offering agent credentials:
- Which enforcement points verify the passport today, and which are planned?
- How does the passport relate to the agent’s identity in your identity provider? Two parallel authorities for one agent are a reconciliation problem waiting to happen.
- How fast does revocation propagate, and what happens to an action already in flight?
- Is the CMDB record behind the scope accurate enough to authorize anything? A credential grounded in stale configuration data signs stale permissions.
That last point is easy to skip. The quality of an authorization is bounded by the data it is computed from. Many enterprises know their CMDB is the least trusted table they own.
Where this leaves buyers
The customer evidence in the release is about inventory, not enforcement: LTM’s CISO says the company has deployed 1,500 agents, each with an employee ID and a manager, and uses ServiceNow’s control tower as their system of record. That is the agent file we argued every production agent needs. AI Passport tries to make the file executable.
If you run agents across several platforms, the useful move before Q4 is a map: every path by which an agent can reach a consequential action, and whether a checkpoint you control sits on it. Where one does, a signed scope can be verified. Where none does, no credential format will help, and that gap is the thing to fix first.