On Thursday, ServiceNow gave enterprise AI agents something they have historically lacked: a verifiable identity with teeth. The company's new AI Passport assigns each deployed agent a cryptographically signed credential that defines not only who the agent is but what it can do, which systems it may touch, and who owns accountability for its actions — with those limits checked and enforced every time the agent attempts to act at runtime.

The launch addresses a structural gap at the heart of enterprise AI security. Zero-trust architecture — the security model that requires every entity to prove its identity before accessing any resource — was built over the past 15 years for humans and devices. AI agents have sat outside that framework: they can be instantiated at scale, inherit shared API keys or service credentials, and take actions across system boundaries without any discrete cryptographic identity that an audit trail can pin down. AI Passport is ServiceNow's answer to the question it created: when an AI agent moves money, updates a record, or touches a customer account, who is it, and did it have permission?

What AI Passport Actually Does Under the Hood

The credential draws on business context from ServiceNow's configuration management database, governance policies, and workflow approvals to establish an agent's permission limits. That distinction matters: most enterprise AI governance tools set permissions at deployment time and leave them static until someone manually reconfigures them. AI Passport checks permissions when an agent attempts an action—enforcing what the business currently allows, not just what someone configured weeks or months ago.

ServiceNow demonstrated this in a live scenario: a third-party customer service agent was configured to process refunds below $25 while disabling unrelated capabilities. An $18 refund proceeded automatically. A $40 request was rejected at runtime for exceeding the threshold for human review. The threshold is a governance rule living in the CMDB; the passport enforces it at the transaction, not at setup.

"Without that baseline, every guardrail is just advisory," said Nenshad Bardoliwalla, senior vice president of AI products at ServiceNow.

AI Passport uses open specifications so other governance products, identity providers, and enforcement systems can issue and verify credentials — designed to support third-party agents as well as ServiceNow's own. The open-spec design is commercially significant: a Futurum Research Signal Report from June 2026 found that the average enterprise runs 3.1 agent orchestration platforms simultaneously. Governance that only covers one vendor's agents governs the minority of any enterprise's actual agent estate.

Why the Industry Needed This Before Thursday

The documented case for this governance layer is concrete. In November 2025, AppOmni researchers reported that default configurations in ServiceNow's Now Assist generative AI platform could be exploited through second-order prompt injection attacks—manipulating agents through data they process rather than direct user commands—to copy and exfiltrate sensitive corporate data, modify records, and escalate privileges. Those attacks succeeded with prompt injection enabled, because the vulnerability lived in agent configuration defaults, not in the protection mechanism itself.

ServiceNow patched the underlying critical vulnerability — CVE-2025-12420, rated CVSS 9.3 out of 10 — in October 2025. But AppOmni researchers noted that configuration choices could still undermine security controls embedded in AI agents. Credential-level identity governance is a different layer from prompt injection defenses — it controls what an agent is permitted to do before it processes any input at all.

Shadow AI compounds the problem. A May 2026 Cloud Security Alliance analysis found that 80% of workers use unapproved tools, with those tools remaining active for a median of 403 days before detection. Gartner projected in April 2026 that by 2028, the average Fortune 500 company will operate more than 150,000 AI agents per company — up from fewer than 15 in 2025. That growth rate, combined with the detection gap, makes AI Control Tower's new shadow AI discovery module commercially urgent alongside the credentialing announcement.

ServiceNow

How Agents Get Controlled — Without a Kill Switch

One of the more practically useful design choices in the new framework is that organizations do not have to choose between "running an agent" and "stopping it completely." Bardoliwalla described the control model as a dimmer switch rather than a binary toggle.

Organizations can pause an agent by revoking its session tokens, restrict its access to approved tools and endpoints, or deactivate it fully by revoking credentials — with deactivated agents subsequently restorable with a recorded explanation.

"You monitor, you pause, you restrict, and eventually, if necessary, you deactivate," Bardoliwalla told reporters during the briefing.

For security and compliance teams reluctant to deploy autonomous agents because stopping a misbehaving one felt like pulling an emergency brake on a running process, the graduated model addresses a real operational concern.

Nvidia Partnership Takes Policy Enforcement to the Infrastructure Layer

Nvidia is a design and launch partner, linking AI Passport with its Open Agent Safety Platform — including the OpenShell secure runtime and Sentry security framework — to connect enterprise policies to infrastructure-level enforcement.

This addresses a known layering problem in enterprise AI. Governance policies defined at the application layer—rules about what an agent should do—often fail to reach the infrastructure where agents run. An agent can have a well-configured passport and still operate in an execution environment that has no way to enforce the limits that passport specifies.

"Making your enterprise policy meaningful at the point of execution" is how Itay Ozery, Nvidia's director of product marketing for cybersecurity, described the core implementation challenge. OpenShell's sandboxed runtime carries policy enforcement from ServiceNow's governance layer down to the compute environment where the agent's actions happen.

The ServiceNow–Nvidia partnership on agent governance extends a relationship announced at Nvidia GTC DC in October 2025, which focused on integrating ServiceNow's intelligent workflows with Nvidia's Enterprise AI Factory infrastructure.

AI Control Tower Expands Shadow AI Coverage and Cost Management

Beyond agent credentialing, AI Control Tower is adding shadow AI detection, more than 400 vendor connectors for discovery, access mapping, and monitoring of agent behavior.

The new AI Cost Management module tracks spending by user, department, and runtime, connecting consumption and quality data with business value metrics. For enterprise finance and IT teams managing AI spend spread across frontier model APIs, AI embedded in SaaS products, hyperscaler credits, and in-house GPU infrastructure, centralized cost attribution addresses a visibility problem that traditional software licensing tools were not built for.

A separate Operational Resilience offering that brings governance, risk, and security together for financial institutions is available immediately. The product targets compliance with operational resilience standards that UK and EU financial regulators have made mandatory for systemically important firms.

EmployeeWorks Gets No-Code Agent Building and Automated Routines

The governance announcement came alongside substantial updates to EmployeeWorks, ServiceNow's employee-facing AI platform — built on the conversational AI and enterprise search technology acquired with Moveworks, the AI startup whose acquisition closed in December 2025 for $2.85 billion.

The third-generation employee-focused AI harness combines reasoning, memory, and connections to business systems, with administrator-defined controls governing what employees can build and access. Productivity Assistants are customizable AI helpers employees can configure for their job function — initial offerings include research and calendaring assistants, along with HR-focused tools for talent insights, HR business partners, and managers in enterprise settings. Productivity Routines handle repeatable tasks in the background — for example, a sales employee could set up an automated pre-meeting routine that reviews the day's meetings, researches prospects, and assembles account materials before the workday starts.

"There's no coding required. It's drag and configure and deploy all within these guardrails," said Bhavin Shah, senior vice president of employee experience at ServiceNow.

A new ToolSmith environment generates tools and integrations from natural-language descriptions. ServiceNow said ToolSmith is trained on more than 75,000 APIs and can plan integrations, retrieve logs, suggest fixes, and support testing — using governed connectors to read and write enterprise data in a preproduction development environment. A Conversations API lets organizations embed EmployeeWorks capabilities in internal applications, kiosks, messaging services, and other AI tools.

How Does This Compare to What Competitors Are Offering?

ServiceNow is not alone in positioning AI governance as its primary competitive differentiator, and the open-spec credential design is a deliberate answer to a crowded landscape.

In September 2026, Salesforce announced a platform extension designed to serve as the central governance layer for all enterprise AI agents, including third-party agents. Microsoft's Agent 365 ecosystem, anchored by Azure AI Foundry and Copilot Studio, gives that company significant distribution advantages through its existing enterprise identity infrastructure (Entra ID) and productivity application footprint. SAP introduced an AI Agent Hub aimed at centralized compliance oversight.

ServiceNow's distinction is that AI Passport uses open specifications—meaning the credential system isn't a ServiceNow-proprietary format, and other governance platforms, identity providers, and enforcement systems can participate as issuers and verifiers. The bet is that enterprises running agents on multiple platforms — the average enterprise ran 3.1 agent orchestration platforms as of July 2026 per VentureBeat Intelligence — will consolidate around a governance framework that spans all of them, rather than one that requires choosing a single vendor's agent ecosystem.

Who Is Using It and What Are They Solving For

NTT Data, one of the world's largest IT services firms, offered an early look at what the combined platform addresses in practice. The company is using AI Control Tower to address shadow IT and is beginning to adopt EmployeeWorks. Among its challenges: overlapping AI tools, duplicate use cases, and fragmented employee systems.

"It takes time to consolidate processes, systems, tools, data," said Jamie Robins, head of NTT Data's ServiceNow practice.

That consolidation story is effectively the market ServiceNow is targeting with today's announcements — enterprises that have moved past AI experimentation and are now confronting the operational reality of running dozens or hundreds of AI agents across business-critical systems, without visibility into what those agents are doing or authority to stop them proportionally when something goes wrong.

Availability and Pricing

AI Passport, shadow AI detection, and AI Cost Management are expected to be available later in Q4 2026. Operational Resilience for financial services is available now. The new EmployeeWorks assistants, routines, harness, ToolSmith, and Conversations API are in a limited, controlled availability rollout.

Pricing combines seat-based licenses with bundled AI credits called "assists," with customers able to purchase additional capacity as usage grows. EmployeeWorks uses the same credit currency as other AI products.

Frequently Asked Questions

How does AI Passport actually enforce limits on an AI agent?

AI Passport issues each agent a cryptographically signed credential that specifies its permitted actions, the systems it can access, and who is accountable for it. Those permissions are drawn from ServiceNow's configuration management database and governance policies. When an agent attempts an action, the system checks the credential against the current permission set at that moment—not when the agent was deployed. An agent trying to process a $40 refund when its credential only authorizes amounts under $25 will be stopped at the transaction, regardless of when or how it was originally set up.

What happens when an AI agent goes rogue or exceeds its authority — does it have to be shut down completely?

Not under ServiceNow's model. AI Passport supports graduated controls: IT or security teams can revoke an agent's session tokens to pause its work, restrict it to a narrower set of approved tools and endpoints, or fully deactivate it by revoking its credential entirely. A deactivated agent can be restored once the responsible team provides a recorded explanation for the override. This "dimmer switch" approach — pause, restrict, deactivate — means organizations do not have to choose between a running agent and a dead one.

Can AI Passport govern AI agents from other vendors, or only ServiceNow's own?

AI Passport uses open specifications, meaning other governance platforms, identity providers, and enforcement systems can participate as credential issuers and verifiers. The intent is to govern third-party agents on the same basis as ServiceNow's own. The Nvidia partnership extends that governance to the infrastructure level through OpenShell, Nvidia's open-source sandboxed runtime—connecting the enterprise policy layer with the compute environment where agents actually run.

Why does the AI agent identity problem matter more now than it did two years ago?

The scale has changed. Gartner projected in April 2026 that by 2028, the average Fortune 500 company will operate more than 150,000 AI agents — up from fewer than 15 in 2025. At the same time, 80% of enterprise workers already use unauthorized AI tools their IT teams have not approved, and those tools remain undetected for a median of over 13 months. An identity and credentialing layer that requires each agent to prove what it is and what it is allowed to do is the foundation that makes governing 150,000 agents tractable.