ServiceNow Launches AI Passport for Agent Governance and Control

ServiceNow Inc. announced new governance controls for artificial intelligence agents today, alongside updates to its EmployeeWorks portal. The company introduced AI Passport, a cryptographically signed credential designed to define an agent’s identity, permitted actions, and accessible systems. These tools aim to help businesses manage autonomous AI while ensuring those tools operate within approved boundaries.

The AI Passport is issued through ServiceNow’s AI Control Tower governance platform and is designed to carry permissions across various agents, tools, and vendors. According to SiliconANGLE, the system performs checks as work executes to enforce limits. Nenshad Bardoliwalla, senior vice president of AI products at ServiceNow, stated that without this baseline, every guardrail is merely advisory. The credential draws on business context from the company’s configuration management database to establish enforceable limits on authority.

Governance and Enforcement Mechanisms

ServiceNow demonstrated the AI Passport capabilities by configuring a third-party customer service agent to process refunds below $25. In the demonstration, an $18 refund proceeded automatically, but a $40 request was rejected at runtime because it exceeded the threshold for human review. This approach supports graduated responses when agents exceed their authority, allowing organizations to pause, restrict, or deactivate agents based on their behavior.

Organizations can pause an agent by revoking session tokens or restrict its access to approved tools and endpoints. Deactivation occurs by revoking credentials, after which agents can be restored with a recorded explanation. Bardoliwalla described the approach as a dimmer switch, where administrators monitor, pause, restrict, and eventually deactivate if necessary. This ensures that identifying agents and monitoring behavior are accompanied by enforceable limits on their operational scope.

Employee Automation Updates

Alongside the governance tools, ServiceNow updated its EmployeeWorks information portal to let employees build specialized assistants. These updates allow workers to automate routine tasks without writing code, addressing the challenge of giving workers tools that can act across enterprise systems. The announcements target businesses expanding their use of autonomous AI, aiming to balance employee empowerment with strict security controls.

Nvidia Corp. is a design and launch partner for these initiatives, linking AI Passport with its Open Agent Safety Platform. This integration includes the OpenShell secure runtime and Sentry security framework, connecting enterprise policies with enforcement within the infrastructure where agents operate. The partnership aims to ensure that governance policies are enforced at the infrastructure level, providing an additional layer of security for autonomous operations.

What should you do?

Security professionals should review their current AI agent deployment strategies to ensure they have mechanisms for enforcing operational boundaries. Organizations using ServiceNow should evaluate the AI Passport feature to see if it meets their governance requirements for autonomous agents. IT teams should assess whether their current monitoring tools provide enforceable limits or just advisory warnings.

What to do and how to stay safe: ServiceNow

• Evaluate current AI agent permissions to ensure they have strict, enforceable boundaries rather than advisory guardrails.
• Review integration capabilities with secure runtime environments to ensure infrastructure-level enforcement of governance policies.
• Implement graduated response protocols for agents that exceed their authority, including pausing and deactivation options.
• Assess the need for cryptographically signed credentials to define agent identity and accountable owners in enterprise environments.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is AI Passport?

AI Passport is a cryptographically signed credential issued through ServiceNow’s AI Control Tower that defines an agent’s identity, permitted actions, accessible systems, and accountable owner.

How does ServiceNow enforce limits on AI agents?

ServiceNow enforces limits by performing checks as work executes, using business context from its configuration management database to establish enforceable boundaries on agent authority.

Who are the partners involved in this announcement?

Nvidia Corp. is a design and launch partner, linking AI Passport with its Open Agent Safety Platform, including the OpenShell secure runtime and Sentry security framework.