ServiceNow's Arc agent is available today. The hardware that would revoke it in a second is not yet

There are two timelines in ServiceNow’s announcement from NVIDIA’s GTC in Berlin on October 21, and they should not be confused.

The first is today. Arc, a personal agent that works for an individual employee across ServiceNow workflows, email, Microsoft Teams and other productivity tools, is generally available as part of ServiceNow EmployeeWorks, included at no extra cost in the Foundation, Advanced and Prime packages. It runs on the Mac now; Windows support is expected “within weeks.” It is long-running, and it builds memory and skills over time.

The second is later. AI Passport, the signed agent credential ServiceNow announced on October 15, will be enforced inside NVIDIA’s OpenShell runtime and on NVIDIA BlueField data processing units, the network cards that sit between a server and the rest of the data center. ServiceNow says a revocation issued in its Control Tower is designed to propagate across software and hardware in about one second, cutting only the revoked agent’s traffic. That capability “is expected to be available in a future release.”

The first timeline puts an agent in front of employees now. The second is what would make its permissions hard to bypass. The work for enterprise teams is the period in between.

Three layers, two of them shipping

When we looked at AI Passport last week, the question was who checks the passport at the door. This announcement starts to answer it, by layer.

Where Arc's permissions are enforced

Hardware: NVIDIA BlueField

• Passport revocation at the network card
• About one second, per agent

Announced for a future release

Runtime: NVIDIA OpenShell

• Systems, APIs and data Arc may reach
• Whatever Arc builds runs inside it

Available with Arc, when Arc runs in OpenShell

Arc

• Email, Teams, workflows
• Memory and skills it accumulates

Generally available on Mac

The design principle is sound and worth copying beyond ServiceNow: the agent should not be the component that enforces its own limits. NVIDIA’s phrasing in the release is the right one, that “policy has to be enforced everywhere an agent runs.” A rule in a prompt can be argued away by a malicious document. A rule in the runtime cannot be argued with, and a rule in the network card cannot even be seen by the agent. We made the same case in prompt guardrails are not a security boundary.

The question the release leaves open

ServiceNow says Arc “can run inside a secure NVIDIA OpenShell runtime or on an employee’s desktop.” The governance description that follows is about OpenShell: IT sets policies in the Control Tower, and OpenShell enforces them. The release does not say which controls apply when Arc runs directly on a laptop, outside that runtime.

That is not a criticism of the product; it is the first question to settle before rollout. A personal agent on a laptop acts with whatever that laptop and that employee’s sessions can reach. Ask ServiceNow, in writing:

1. When Arc runs on the desktop, which Control Tower policies still apply, and what enforces them?
2. Can IT require OpenShell for some employees or some tasks, and block desktop mode?
3. Where do Arc’s memory and the skills it builds live, who can read them, and how are they deleted when the employee leaves?
4. Which actions in email and Teams does Arc take without a confirmation, by default?

A personal agent is a new kind of identity

Arc is not a workflow bot owned by a process team. It works for one person, across that person’s applications, for as long as it is allowed to run. That gives it the reach of an assistant with the persistence of a service account. Two consequences follow.

Offboarding has a new step. When the employee leaves or changes roles, the agent’s access, memory and skills have to follow the same lifecycle. We wrote about this when Google gave coworker agents an email address and a directory entry; a personal agent adds the accumulated memory to what has to be closed down.

Revocation speed becomes an incident metric. The one-second BlueField claim describes a planned architecture, and it is a vendor figure. Until it ships, measure what you have: from the moment security decides to stop one employee’s agent, how long until it can no longer act, and does stopping it disturb anyone else? If the answer is “we would disable the user,” the agent and the person are not yet separable, and they should be.

In the meantime

Included at no extra cost means Arc will reach employees quickly in companies that already pay for EmployeeWorks. Treat it as a pilot with an owner, not a feature toggle: start with OpenShell where you can, limit desktop mode to a named group, keep confirmation on for anything that sends, approves or deletes, and write down the revocation procedure before the first agent goes live. When the hardware enforcement ships, you will know exactly which gap it closes.