--- title: "ServiceNow AI Passport: AI agent permissions at runtime" description: "ServiceNow AI Passport (announced October 15, 2026) gives each AI agent a signed credential checked at runtime. How it differs from AI Gateway, NVIDIA's role, and open questions." url: https://udon-dev.com/en/notes/servicenow-ai-passport/ lang: en published: 2026-10-16 topic: [servicenow, security] tags: ["servicenow", "ai-control-tower", "ai-agent", "mcp", "nvidia"] --- # ServiceNow AI Passport: AI agent permissions at runtime - AI Passport issues a signed credential to each AI agent and checks, while the agent is running, whether it is staying within what it is allowed to do. Third-party agents are covered too - Credentials are grounded in the CMDB, GRC policies and workflow approvals. An agent that goes out of bounds can be redirected, restricted, reconnected with the right context, or stopped - Availability is planned for Q4 2026. The name of the specification, pricing, required licenses and availability in Japan are not stated in the sources I could find On October 15, 2026, ServiceNow [announced](https://newsroom.servicenow.com/press-releases/details/2026/ServiceNow-advances-its-operational-harness-for-enterprise-AI-with-AI-Passport-and-expanded-governance-capabilities/default.aspx) AI Passport, which checks AI agent permissions at runtime. ServiceNow already offers AI Gateway as a generally available part of AI Control Tower; it governs which MCP servers an agent can connect to. How is AI Passport different from AI Gateway? Does it work for other vendors' agents? When can you use it? I checked ServiceNow's community posts and documentation, along with press coverage. ## A signed credential for each agent The press release calls AI Passport an "authority layer." It lets organizations control, at runtime, what AI agents and MCP servers are allowed to do at any point in a workflow where multiple agents work together. At its core is a cryptographically signed credential. While an agent runs, it consults this credential to check what it is allowed to do. The example given of where the credential is consulted is NVIDIA's OpenShell, a runtime that runs agents in isolation. One credential is issued per agent. ServiceNow's Control Tower issues it. The credential is grounded in configuration data from the CMDB (configuration management database), GRC (governance, risk and compliance) policies, and workflow approvals. The press release puts particular weight on giving third-party agents a verifiable record of authority instead of relying on their own claims. For governing third-party agents, it also mentions targeted revocation of credentials and narrowing the scope with each successive delegation. ## Graduated responses when an agent goes out of bounds Agents that stay within their bounds can act freely. When an agent goes out of bounds, the press release says it can be redirected, restricted in what it can do, reconnected with the right context, or, if necessary, stopped with a kill switch. The kill switch is said to work "at machine speed." Both the press release and Techstrong.ai point to the same distinguishing feature: it prevents out-of-bounds actions up front instead of relying on audit logs after the fact. ## How it differs from the existing AI Gateway AI Gateway is the part of AI Control Tower that handles MCP connections. According to the [AI Gateway FAQ](https://www.servicenow.com/community/ai-control-tower-articles/ai-gateway-faq/ta-p/3587429), it works like this. An agent builder requests that an MCP server be added, and a governance or security owner (the AI Steward) approves it. Servers that have not been approved do not appear in the AI Agent Studio configuration screens. Connections pass through the AI Gateway proxy and authenticate with OAuth 2.1, so agents never connect to MCP servers directly. Owners can pause a server or tool immediately, but pausing or resuming can take up to 10 minutes to take effect because of cache refresh. It is not limited to agents built in ServiceNow. It can also govern connections from agents in Copilot Studio, AWS Bedrock, Google Vertex AI and others. AI Gateway is included in AI Control Tower Core and Pro Plus, with no separate purchase. AI Gateway governs "which MCP servers you may connect to" along the connection path. AI Passport gives the agent itself a credential and has it checked at each step of the workflow. The press release headline says it is "enforceable at the edge," which suggests the aim is to make the check possible in runtimes outside ServiceNow as well. How the two relate, however (whether AI Passport replaces AI Gateway or is used alongside it), is not explained in any source I could find. ## The "open specification" and NVIDIA's role AI Passport is said to be built on an open specification. ServiceNow is not the only party that can issue and verify credentials. The explanation is that other governance products, identity providers and enforcement points can also handle credentials for both first-party and third-party agents. Constellation Research also reports that other vendors can issue credentials themselves. Which specification it is based on (its name or where it is published), however, is not stated in the press release or in the coverage. NVIDIA is the design and launch partner. It is building a production-ready enforcement implementation using NVIDIA's [Open Agent Safety Platform](https://www.nvidia.com/en-us/solutions/ai/agent-safety/). The platform has two components: OpenShell and Sentry. OpenShell is an open-source runtime published on GitHub. According to TNW, each agent runs in its own sandbox, and the operator decides which files, network access, tools and credentials it can use. OpenShell checks and enforces those limits at runtime. Sentry is a monitor that runs on a BlueField-4 DPU (a data processing chip), separate from the machine the agent runs on. NVIDIA says it can isolate an agent that tries to leave its boundary within milliseconds. NVIDIA's page positions it as a component for organizations that want to add a further independent layer. In May 2026, ServiceNow and NVIDIA also announced [a desktop agent that runs on OpenShell (Project Arc)](https://newsroom.servicenow.com/press-releases/details/2026/ServiceNow-extends-agentic-AI-governance-from-desktops-to-data-centers-with-NVIDIA/default.aspx). That announcement said AI Control Tower sets the policy and records the files the agent read, the commands it ran and the APIs it called. AI Passport appears to add per-agent credentials to that combination. ## Discovery and cost management announced alongside it Alongside AI Passport, ServiceNow also announced features for AI inventory and cost. - **Shadow AI detection**: finds unapproved AI agents running on the network - **More than 400 prebuilt connectors**: make it possible to discover AI across products and vendors - **Access mapping**: bases authorization decisions on actual entitlements - **Cost management**: tracks spending by user, department and runtime. "AI Cost Management" is added as part of IT Asset Management (ITAM), bringing the costs of frontier models, AI embedded in SaaS, hyperscalers and data center GPUs into a single view - **Policy enforcement**: responds in stages of warning, throttling and blocking AI Control Tower's August and September 2026 releases already collect token consumption from ServiceNow assists and third-party AI, and can track and allocate the costs. Breakdowns by department and user, however, are limited to ServiceNow's AI agents and Anthropic's AI (see also [my article on assist consumption](/en/notes/servicenow-now-assist-usage-metering/)). What reads as new in AI Cost Management is that it pulls everything together on the IT Asset Management side, as far as AI embedded in SaaS and data center GPUs. For financial institutions, ServiceNow also released "Operational Resilience." As background, ServiceNow cites its 2026 survey, the Banking AI Maturity Index: 100% of banks use AI, but only 24% have governance to match. ## How it differs from Microsoft Entra Agent ID The closest product for comparison is Microsoft's [Entra Agent ID](https://learn.microsoft.com/en-us/entra/agent-id/). It gives AI agents an identity and lets organizations manage, govern and protect them. It is described as authenticating through OAuth 2.0 flows and as able to connect agents from AWS Bedrock and n8n as well. Comparing the two, the difference appears to be that Entra Agent ID manages permissions through Entra identities, while AI Passport grounds credentials in the CMDB and workflow approvals. Organizations already using Entra Agent ID will likely want to confirm, before AI Passport ships, how its "open specification" connects to identity providers such as Entra. ## The announcement says "Super Intelligence Control Tower" In this press release, the product that issues credentials is written as "Super Intelligence Control Tower." In the May 2026 announcement and the Brazil release documentation, it was "AI Control Tower." Constellation Research and ITdaily reported this announcement as an extension of AI Control Tower. According to ITdaily, ServiceNow has also started to change what it calls itself. The new name is "Super Intelligence Control Tower for business reinvention." Whether the product has been formally renamed cannot be determined from the sources I could find. Whether names change in the admin screens and documentation will need to be checked in release notes from Brazil onward. ## Availability and what is still unknown According to the press release, AI Passport, shadow AI detection and AI Cost Management are planned for availability in Q4 2026. Operational Resilience was available at the time of the announcement. The sources I could find did not answer the following. - **Pricing and required licenses**: The AI Gateway FAQ says AI Gateway is included in AI Control Tower Core and Pro Plus. No source says whether AI Passport will be treated the same way - **Name of the specification**: What the "open specification" refers to, and where it will be published - **Runtimes other than OpenShell**: OpenShell is the only runtime named as a place where credentials are consulted. When and how other agent platforms will support it is not stated - **Availability in Japan and Japanese-language materials**: No regions are listed, and I found no announcement from ServiceNow Japan ServiceNow's AI service desk, [Flow](/en/notes/servicenow-flow-ai-service-desk/), can be called from other AI tools over MCP. Whether Flow's agents will also be issued an AI Passport is not clear from the announcement.