ServiceNow will issue every AI agent a signed passport defining what it may do, with NVIDIA building the enforcement

ServiceNow will give every AI agent running inside an enterprise a cryptographically signed credential stating what it is authorised to do, which is verified at runtime at every step of a multi-agent workflow. The product, AI Passport, is expected to be available in Q4 2026 alongside shadow AI detection and AI Cost Management, according to the company’s announcement on 15 October. NVIDIA is the design and launch partner, building a production-ready enforcement implementation on its Open Agent Safety Platform.

“As AI agents proliferate across the enterprise, visibility alone isn’t enough. Enterprises need confidence that every AI agent is operating within its authorised scope,” said Jon Sigler, executive vice president and general manager, AI Platform at ServiceNow. “ServiceNow closes that gap with an operational harness across AI Passport and Super Intelligence Control Tower, unifying agent authority, governance, and operational oversight so enterprises can scale agentic AI with control.”

The passport is issued by Super Intelligence Control Tower, the product ServiceNow presented as AI Control Tower during a press and analyst briefing on 13 October. Each credential draws on the enterprise’s live business context through ServiceNow’s Configuration Management Database (CMDB), its governance, risk and compliance (GRC) policies, and workflow approvals. For third-party agents, the company said, this creates a verifiable permissions record in place of reliance on an agent’s own claims about what it is allowed to do.

A kill switch needs a baseline

“You can’t control what you can’t identify, and you can’t govern what you can’t see,” said Nenshad Bardoliwalla, senior vice president of AI Products at ServiceNow, during the briefing. He said the single red shutdown button makes for good stories and poor oversight. “Real governance is graduated. It’s more like a dimmer switch. You monitor, you pause, you restrict, and eventually, if necessary, you deactivate.”

“You can’t enforce any of those controls without knowing what the agent is authorised to do in the first place. Without that baseline, every guardrail is really just advisory,” Bardoliwalla added. “Without Passport, a kill switch has no baseline. With AI Passport, it has context, and that context is what enables real governance at scale.” When an agent drifts outside its scope, the release states, enforcement can redirect it, restrict it, reconnect it with proper context or, if termination is needed, shut it down at machine speed.

A demonstration showed how narrow that scope can be. A ServiceNow presenter took an out-of-the-box “Order Issues and Refunds” agent from a third-party vendor, which declared five skills, and limited it to refund processing for a hypothetical beverage company. During pre-flight checks, Control Tower flagged that the agent had no ceiling on the money it could refund, disabled the four unused skills and accepted a $25 limit. Two requests followed. The $18 refund executed automatically. The $40 request passed through the same orchestrator and MCP server and was rejected at runtime, then routed for human review.

NVIDIA carries the policy into the runtime

AI Passport is built on open specifications, so any governance product, identity provider or enforcement point can issue and verify credentials for its own agents and those of other vendors. The NVIDIA implementation uses the Open Agent Safety Platform, which includes the OpenShell open-source secure runtime and the NVIDIA Sentry security framework.

“As agents take on more work, they also need more authority. They’re accessing enterprise data using tools, delegating tasks to other agents, and taking actions that affect the business,” said Itay Ozery, director of Product Marketing for Networking and Cybersecurity at NVIDIA, at the briefing. “The hardest part is making enterprise policy meaningful at the point of execution. Most enterprises already have identities, access controls, approval flows and security tools. All of those controls were largely built around people and applications, with relatively predictable behaviour. The challenge with agents is that they can choose tools dynamically and they can pass work to other agents.”

“It can also provide independent protection if an agent is able to escape its software boundary, or the host becomes compromised,” Ozery said of the infrastructure layer’s role. In the release, he added: “By implementing AI Passport with the NVIDIA Open Agent Safety Platform, ServiceNow customers can continuously verify and enforce what every agent is authorised to do, at machine speed and at runtime.”

“We see it as having the potential to become an industry standard,” Bardoliwalla said, in response to an audience question on whether the passport works only with agents built on ServiceNow. Policies are set centrally in Control Tower and enforced through several routes, including over the network and through an agent SDK. “We are very open to partnering, to getting feedback, to changing the definition of the passport so that it meets multiple vendors’ needs. I think it becomes much more powerful in that scenario than if it’s just isolated to something that ServiceNow as a company promotes.”

ServiceNow is betting on a single graph

Control Tower now brings five capabilities into one product, Bardoliwalla said: discovery through connectors and network scanning; observability, with evaluations run on traces of agents and models; governance, risk and compliance against regimes such as the EU AI Act and the NIST risk management framework; security, with identity integrated through Veza; and cost and value measurement. “We are the only product that brings all five of those pieces together holistically, connecting the dots into the same platform,” he said.

“Customers are telling us that they see nice solutions being created by the hyperscalers. The second I ask them, ‘So, are you going to use hyperscaler one’s governance environment for hyperscaler two?’, they’re like, ‘No,’” Bardoliwalla said. “Our control tower is built on top of our CMDB technology. All the business services, all the policies, all of the assets that you have spent years modelling inside your systems are now connected through this one central graph.”

The new discovery tools sit on that graph. They include shadow AI detection that finds unapproved agents running on the network, more than 400 out-of-box connectors that will enable discovery across platforms and vendors, access mapping that grounds authorisation decisions in actual entitlements, and continuous observability of agent traces and behaviour. Shadow AI capabilities from Armis and access maps from Veza are bundled into the base Control Tower package, Bardoliwalla said, adding that AI Passport itself is not built on Veza.

Banks and global employers test the model at scale

ServiceNow’s own 2026 Banking AI Maturity Index found that while 100% of banks report using AI, only 24% have the governance to match it. The company is pitching a new Operational Resilience solution for financial services, available now, which gives chief risk officers and chief information security officers the same real-time view of ungoverned assets, identities and agents across IT, OT, cloud and third-party systems. The release describes Control Tower as treating a rogue agent like any other exposed asset, so banks can triage, contain and revoke access inside a regulatory notification window.

“We have deployed 1,500 AI agents across the organisation, each assigned an employee ID and manager to ensure accountability, oversight, and continuous improvement,” said Chandan Pani, chief information security officer at LTM. “ServiceNow Super Intelligence Control Tower provides a single system of record for these AI agents, giving us centralised visibility into inventory, risk, and compliance.”

“We operate in more than 200 countries and territories with over 350,000 employees, and we want agentic AI in every corner of that business. A governance foundation is what makes scaling to that level possible,” said Maximiliano Garnica Pineda, AI and innovation lead at PepsiCo.

Employees feel governance long before they see it

NTT Data shows what ungoverned growth looks like from the inside. The company employs about 660,000 people across more than 70 countries, has inherited roughly 2,500 applications through acquisitions and runs nine HR information systems, according to Jamie Robbins, head of the ServiceNow practice at NTT Data. “AI is growing faster than anyone predicted, and it’s growing faster than we can see it,” Robbins said. “I’ve got five different productivity agents asking the same question, all doing the same thing from different places.”

“If I’ve got a global team on multiple HRISs, I have to go into three different HRISs just to check my team’s leave,” Robbins said, describing the experience of a manager. “By the time we get everyone on the same system, it could be another 18 months to create that visibility, which we can create maybe tomorrow with EmployeeWorks.”

EmployeeWorks, ServiceNow’s employee-facing AI front door, launched in February and has millions of users across its web app, Teams and Slack, in a hundred languages. The briefing added persona-based productivity assistants, no-code productivity routines for repeatable tasks, a Conversations API that exposes the system to third-party apps and agents including Claude and ChatGPT, and Toolsmith, a natural-language tool for building connectors. Bhavin Shah, senior vice president of the Employee Experience Group, said routines are validated by the Control Tower architecture and the passport layer. “It’s about following the rules that you’ve established, the business processes. We know it can sometimes be hard to get these models and these harnesses to do things very deterministically,” he said.

“What used to take weeks or months is now taking minutes,” Shah said of Toolsmith. Asked whether it writes directly to operational systems, he said Toolsmith builds and tests in a pre-production environment and relies on connectors that the organisation has already governed and validated, which “aren’t code written on the fly”.

Cost is becoming a governance problem

Control Tower now includes cost governance by user, department and runtime spend, and value intelligence that connects consumption, cost, quality and realised user value. AI Cost Management, part of IT Asset Management and expected in Q4 2026, will bring frontier model, embedded SaaS AI, hyperscaler and data centre GPU costs into a single view and alert teams to potential budget overruns. A policy enforcement capability will manage graduated responses that escalate from alert to throttle to block.

“Our business model is a hybrid that combines the predictability of a seat-based licence with the entitlement of what we call assists, which is our credit system for AI,” Bardoliwalla said of pricing, in response to a question on consumption costs for autonomous and third-party agents. “Nobody wants to pre-buy a bunch of things that they’re not going to use. If you can’t forecast and give somebody a budget, most execs are not going to be happy with you.”

“They’ve seen it just run the meter on token usage, and they’re like, ‘Look, this is not a very hard problem. Shift my vacation by a week. That should be a simple task,’” Shah said of customers who connected frontier models directly to enterprise systems. “In our world, that might be a handful of assists, no matter what model we’re using.”

Autonomy will be earned in stages

A question from the briefing audience cited research suggesting that while more than 90% of organisations have deployed agents, only 10% to 15% use kill switches today. Bardoliwalla said he expects human approvers to remain the starting point for most customers, with automation granted once a task has been solved enough times to run on a provable, repeated basis.

“You still want the system to be able to say, ‘I’m 70% sure this is the right decision,’ and we, the folks in the business, should be able to say, ‘70% is not good enough. If you can’t cross the 90% threshold, I want you to come back to me and ask me before you try to approve this thing,’” Bardoliwalla said. “Many, if not most, will start with the human approver. Only when they meet the right criteria, only when they’ve gone through the process, will they run the switch to run autonomously. And even there, there’s always an exit.”

Much of the roadmap remains forward-looking. AI Passport, shadow AI detection and AI Cost Management are expected in Q4 2026, the connector expansion and graduated policy enforcement are described as future capabilities, and ServiceNow’s own release cautions that delays, regulatory changes and uncertain demand could alter what is delivered. The passport’s ambition to become a cross-vendor standard also depends on adoption beyond ServiceNow’s partners, in a market where identity providers such as Okta, with which ServiceNow has a partnership on the topic, are expanding into similar territory.

“We actually start to direct them to value quicker,” Robbins said of what comes next at NTT Data, where Control Tower will be used to match employees’ requests to use cases that already exist. “Employees aren’t requesting the same thing again.”