ServiceNow Renames AI Control Tower, Adds Verifiable Agent Identities

ServiceNow has updated its AI Control Tower with new governance features and renamed the component Super Intelligence Control Tower, or SICT. The company also announced updates to EmployeeWorks to simplify the creation of AI agents, according to reports from InfoWorld and Computerworld.

The primary addition is AI Passport, a new component within SICT that assigns verifiable identities to all AI agents. This applies to both ServiceNow-built agents and third-party solutions. The passport functions as a cryptographically signed credential that is checked at runtime to verify the scope authorized by the enterprise, ensuring agents operate within defined limits.

Governance and Runtime Controls

Nenshad Bardoliwalla, SVP of AI product management at ServiceNow, stated that enterprises face challenges when scaling autonomous agents from pilots to production. He noted that without the ability to identify running agents, their actions, and their system access, scaling becomes a significant risk. AI Passport addresses this by providing continuous verification of agent permissions.

When an agent remains within its passport scope, it operates freely. If it attempts to deviate, the system enforces predefined actions. These responses can include redirecting the agent, restricting its access, reconnecting it with proper context, or triggering a kill switch. All enforcement actions are audited to allow for complete tracking of agent activity.

Third-Party Integration and Industry Analysis

The AI Passport system is built on open specifications, allowing any governance product or identity provider to issue and verify credentials. This ensures that credentials remain verifiable at every step in multi-agent workflows, even when third-party agents are involved. The approach moves beyond internal controls to address broader ecosystem risks.

Frank Dickson, principal analyst at Dickson Research, described the move as a significant advancement in agent governance. He compared traditional governance to a security camera that records events for later review, whereas AI Passport acts as a bouncer at every door. Dickson emphasized that the passport replaces an agent’s own claims about its permissions, which he called an Achilles’ heel of agentic AI.

Dickson cautioned that the trustworthiness of the passport depends on the issuing office, which includes ServiceNow’s CMDB, GRC policies, and workflow approvals. If that underlying data is stale, the passport is also stale. He noted that while ServiceNow built on open specifications, the value depends on adoption by others. Nvidia is a launch partner, and ServiceNow stated that enforcement implementation is still being built.

What should you do?

Security teams should review their current AI agent deployment strategies to ensure they align with the new governance capabilities offered by SICT. Organizations using third-party AI agents should verify how these agents will integrate with the AI Passport system and whether their existing identity providers support the open specifications.

What to do and how to stay safe: ServiceNow

• Audit existing AI agent deployments to identify which agents lack verifiable identities or runtime scope verification.
• Review the data freshness of your CMDB and GRC policies, as stale data will compromise the validity of AI Passports.
• Monitor vendor updates regarding the enforcement implementation status, as ServiceNow indicated this component is still being built.
• Evaluate third-party AI agent integrations to ensure they can issue and verify credentials according to the new open specifications.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the new name for ServiceNow's AI Control Tower?

ServiceNow has renamed its AI Control Tower to Super Intelligence Control Tower, or SICT, according to InfoWorld.

How does AI Passport verify agent permissions?

AI Passport uses cryptographically signed credentials checked at runtime to verify the scope authorized by the enterprise.

What happens if an AI agent deviates from its scope?

Defined actions are enforced, which can include redirecting, restricting, reconnecting the agent, or triggering a kill switch.