ServiceNow is taking aim at a basic problem in enterprise AI. Knowing that an agent is legitimate does not mean every action it takes should be trusted. On Thursday, the company announced AI Passport, which is designed to define and enforce what an agent is allowed to do.
Built into ServiceNow’s AI Control Tower, AI Passport gives agents a signed set of permissions defining what they can access and which actions they are authorized to take. Those permissions can then be checked as an agent moves across tools, MCP servers and enterprise systems.
The announcement puts ServiceNow into a broader contest over where control of autonomous AI agents should live. Okta, Microsoft, Salesforce, NVIDIA and others are attacking the same problem from different parts of the enterprise stack, from identity and workflow to orchestration and runtime enforcement.
Where ServiceNow Has Leverage
ServiceNow comes at it from the enterprise workflow side, where it already has a substantial foothold. The company says it has nearly 9,000 customers, including 90% of the Fortune 500, and is embedded across IT, HR, security, customer service, finance and other core business functions.
That position gives ServiceNow access to much of the context needed to decide what legitimate agent behavior should look like, including workflows, assets, permissions, policies and approval processes.
NVIDIA’s Itay Ozery, director of product marketing for cybersecurity, described that advantage during a media briefing ahead of the announcement.
“ServiceNow understands how the enterprise operates — the workflows, the assets, the permissions, the policies — and really determine[s] what the agent should be allowed to do,” Ozery said. “And that context is what makes AI Passport so meaningful.”
From Business Rules to Hard Stops
NVIDIA is more than an outside observer. On Sept. 28, it launched its Open Agent Safety Platform, aimed at enforcing agent boundaries closer to the runtime and infrastructure. ServiceNow is among the organizations working with NVIDIA on that effort.
The two companies attack different layers of the same problem: ServiceNow defines the business authority; NVIDIA helps enforce it where the agent runs.
The relationship is already technical. ServiceNow said in May that AI Control Tower had been incorporated into NVIDIA’s Enterprise AI Factory design, while its Project Arc agent runs inside NVIDIA OpenShell. AI Passport now connects that business-level authority to NVIDIA’s runtime enforcement layer.
How the Passport Gets Checked
But visibility alone is not enough. “Real governance is graduated. It’s more like a dimmer switch,” Bardoliwalla said. “You monitor, you pause, you restrict, and eventually, if necessary, you deactivate.”
The missing ingredient, Bardoliwalla said, is an authorized baseline. “Without that baseline, every guardrail is really just advisory,” he said. AI Control Tower establishes that baseline using business context including ownership, policies, permitted systems and approved actions. AI Passport expresses the scope as a signed credential carried with the agent.
In shorthand, ServiceNow decides what the agent may do. The Passport carries that decision, runtime controls check it, and enforcement can allow, restrict or block the action.
The $25 Test
ServiceNow demonstrated the system with a customer-refund agent. An administrator limited the agent to refunds below $25 and disabled four skills it did not need. An $18 refund moved through the orchestrator and an MCP server and executed automatically.
A $40 refund followed the same path but was rejected at runtime and sent for human review because it exceeded the authorized ceiling. “Instead of trusting an agent…to police itself, we read every passport at every layer and enforce it the moment a decision gets made,” a ServiceNow presenter said during the demonstration.
That is essentially runtime authorization for AI agents. It also fits the pattern SPB found in its earlier reporting on who gets to control the AI agent. Identity establishes who or what is acting, while authorization and runtime enforcement determine whether the action should proceed.
Authority Has to Travel
The harder problem begins when an agent leaves one system, calls an MCP server or delegates work to another agent. “As agents take on more work, they also need more authority,” Ozery said.
Traditional access controls were largely designed for people and applications with more predictable behavior, he said. Agents can dynamically choose tools and pass work to other agents. “That means that authority has to follow that work, and delegation has to…stay within the original scope,” Ozery said.
ServiceNow says AI Passport expresses that authority as a cryptographically signed credential that can be verified as work moves across agents and tools. NVIDIA’s infrastructure provides one possible enforcement layer beneath it. Together, the approaches illustrate an increasingly recognizable agent-security stack in which enterprise systems define authority and runtime systems enforce it.
Everybody Wants the Choke Point
ServiceNow is hardly alone. Okta and Microsoft are extending identity and administration controls to non-human agents. Salesforce is pushing governance through orchestration. AWS and Google Cloud are controlling agents inside their clouds. NVIDIA and security vendors are moving enforcement closer to the runtime.
They are converging on the same problem of how to define an agent’s authority, carry those permissions across tools and systems, and retain the ability to stop an action when it exceeds that authority.
SPB has been tracking that market in its agent control-plane coverage and in a follow-up look at eight places vendors think an agent needs a leash. ServiceNow plants its flag in workflows.
At Oktane last month, Okta outlined an overlapping approach built outward from identity, including agent discovery, an inline gateway and kill-switch capabilities. SPB covered that push in Okta CEO Lays Out AI Agent Security Push at Oktane 2026.
Asked whether AI Passport would apply only to ServiceNow-built agents, Bardoliwalla said no. “Agent Passport is unequivocally not just for ServiceNow AI,” he said. “We see it as having the potential to become an industry standard.”
He also acknowledged that no single vendor is likely to own the entire control layer. ServiceNow is “very open to partnering,” he said, including potentially changing the Passport definition to meet the needs of other vendors.
ServiceNow says AI Passport is expected to become available in the fourth quarter and is being built on open specifications intended to let other governance platforms, identity providers and enforcement systems issue or verify the credentials.
Who Gets the Final Veto?
That interoperability may ultimately matter more than the Passport metaphor. An agent can have a legitimate identity and still attempt an action it should not take. It can cross vendor boundaries, call an MCP server, invoke a tool or delegate work while carrying authority with it.
The market increasingly looks less like one universal agent control plane than a stack of cooperating controls. The hard part is making authority survive every handoff while ensuring something outside the agent still retains the power to say no.
