ServiceNow AI Passport: Signed IDs for Every Enterprise AI Agent

ServiceNow wants every AI agent inside an enterprise to carry credentials. The company unveiled AI Passport on October 15, a system that issues each agent a cryptographically signed credential spelling out exactly what the agent is authorized to do, and then verifies that authorization at runtime at every step of a multi-agent workflow.

The announcement, reported by The Source Code, positions the passport as the missing foundation for agentic AI governance. According to the company's announcement, the product is expected to become available in the fourth quarter of 2026, alongside shadow AI detection and AI Cost Management. NVIDIA is the design and launch partner, and it is building a production-ready enforcement implementation on its Open Agent Safety Platform.

The idea is simple to state and hard to build: visibility alone is not enough when software agents multiply across a company. Executives at the briefing argued that enterprises need confidence that every agent is operating within its authorized scope, and that AI Passport closes that gap by pairing the credential with a control system the company calls the Super Intelligence Control Tower, unifying agent authority, governance, and operational oversight so agentic AI can scale with control.

How the AI Passport credential works

Each passport is issued by the Super Intelligence Control Tower, a product ServiceNow presented under the name AI Control Tower during a press and analyst briefing on October 13. According to The Source Code's coverage of that briefing, every credential draws on the enterprise's live business context through ServiceNow's configuration management database, its governance, risk and compliance policies, and workflow approvals.

For third-party agents, the company said, the passport creates a verifiable permissions record instead of relying on the agent's own claims about what it is allowed to do. That distinction matters because agents choose tools dynamically and can pass work to other agents, which makes self-declared permissions unreliable.

A demonstration at the briefing showed how narrowly a passport can scope an agent. A presenter took an off-the-shelf order-issue-and-refund agent from a third-party vendor that declared five skills, and restricted it to refund processing for a hypothetical beverage company. During pre-flight checks, the Control Tower flagged that the agent had no ceiling on the money it could refund, disabled the four unused skills, and accepted a twenty-five-dollar limit. Two requests followed: an eighteen-dollar refund executed automatically, while a forty-dollar request passed through the same orchestrator and was rejected at runtime, then routed for human review.

The enforcement philosophy behind that demo was spelled out by Nenshad Bardoliwalla, ServiceNow's senior vice president of AI Products, in remarks reported by The Source Code. He argued that a single red shutdown button makes for good stories and poor oversight, and that real governance works more like a dimmer switch: monitor, pause, restrict, and only then, if necessary, deactivate. According to the release, when an agent drifts outside its scope, enforcement can redirect it, restrict it, reconnect it with proper context, or, if termination is needed, shut it down at machine speed.

NVIDIA carries the policy into the runtime

AI Passport is built on open specifications, so any governance product, identity provider, or enforcement point can issue and verify credentials for its own agents and those of other vendors. The NVIDIA implementation uses the Open Agent Safety Platform, which includes the OpenShell open-source secure runtime and the NVIDIA Sentry security framework.

Itay Ozery, director of product marketing for networking and cybersecurity at NVIDIA, told the briefing that the hardest part of agent governance is making enterprise policy meaningful at the point of execution, according to The Source Code. Most enterprise controls were built around people and applications with relatively predictable behavior; agents, by contrast, choose tools dynamically and delegate to other agents. Ozery added that the infrastructure layer can provide independent protection even if an agent escapes its software boundary or the host becomes compromised.

ServiceNow said it hopes the passport can become an industry standard rather than a single-vendor feature. In response to an audience question about whether the credential works only with agents built on ServiceNow, Bardoliwalla said the company is open to partnering and to changing the passport's definition so it meets multiple vendors' needs, because the system becomes more powerful when it is shared across the market.

That cross-vendor ambition matters for the wider agent ecosystem. Registration, identity, and verification layers are the plumbing that lets agents from different builders work together safely, a theme also visible in the way enterprise agent platforms are racing to add governance around hiring, retail, and customer-service agents, as recent coverage of agent launches shows.

The governance wave is arriving with the agents

The Control Tower brings five capabilities into one product, according to the briefing: discovery through connectors and network scanning; observability with evaluations run on traces of agents and models; governance, risk and compliance against regimes such as the EU AI Act and the NIST risk management framework; security, with identity integrated through Veza; and cost and value measurement. The new discovery tools include shadow AI detection that finds unapproved agents running on the network, more than four hundred out-of-box connectors for discovery across platforms and vendors, and continuous observability of agent traces and behavior.

The gap the company is targeting is real. ServiceNow's own 2026 Banking AI Maturity Index found that while every surveyed bank reports using AI, only about a quarter have the governance to match it. The company is pitching a new Operational Resilience solution for financial services that treats a rogue agent like any other exposed asset, so banks can triage, contain, and revoke access inside a regulatory notification window.

Early customers are already operating at agent scale. LTM chief information security officer Chandan Pani said the firm has deployed fifteen hundred AI agents across the organization, each assigned an employee ID and manager for accountability, with the Control Tower as the single system of record. PepsiCo's AI and innovation lead Maximiliano Garnica Pineda pointed to the company's footprint in more than two hundred countries and said a governance foundation is what makes scaling agentic AI to that level possible. Jamie Robbins, head of the ServiceNow practice at NTT Data, described the inside view of ungoverned growth: five different productivity agents asking the same question from different places, growing faster than anyone can see.

Cost is becoming part of governance too. The Control Tower now includes cost governance by user, department, and runtime spend, plus value intelligence connecting consumption, cost, quality, and realized user value. AI Cost Management, expected in the fourth quarter, will bring frontier model, embedded AI, hyperscaler, and data center GPU costs into a single view and alert teams to potential budget overruns, with graduated responses that escalate from alert to throttle to block.

Not everything is shipping today. Much of the roadmap remains forward-looking: AI Passport, shadow AI detection, and AI Cost Management are all expected in the fourth quarter, and the company's own release cautions that delays, regulatory changes, and uncertain demand could alter what is delivered. The passport's ambition to become a cross-vendor standard also depends on adoption beyond ServiceNow's partners, in a market where identity providers such as Okta are expanding into similar territory.

The same week underscored how fast the agent infrastructure layer is moving: Meta released an open-weight model built for coding and agentic workloads, reported by Reuters, putting more raw capability in developers' hands even as enterprises race to govern it.

Still, the direction is clear. Retail is already moving from AI insight to approved action, as seen in the newest wave of retail agent rollouts, and every one of those approvals presumes someone knows exactly what the agent is allowed to touch. ServiceNow is betting that the answer looks less like a chatbot and more like a credential.