On October 15, 2026, ServiceNow announced AI Passport, a new capability inside its newly renamed Super Intelligence Control Tower. The idea, as the company describes it: every AI agent gets a cryptographically signed credential that validates what it can and cannot do, and that authority is tied to the business context in which the agent operates.
It is the most concrete productization yet of an idea the whole industry is converging on: agent trust cannot rest on vibes, it needs verifiable credentials. And it lands the same week Workday announced its acquisition of C1.ai to become the identity layer for people and agents. Two of the largest enterprise platforms are now building the same control plane from opposite ends.
What AI Passport actually is
According to ServiceNow, and as reported by diginomica's Derek du Preez from the announcement briefing:
- A signed credential per agent. AI Passport is a cryptographically signed credential assigned to individual agents that validates what it can and cannot do.
- Authority drawn from business context. It draws on the business context held in ServiceNow's Configuration Management Database (CMDB), plus governance policies and workflow approvals, so the agent is verified at every step as it moves between workflows and tools.
- Graduated enforcement. Controls can restrict or stop an agent when it moves beyond its boundaries, what ServiceNow calls a soft kill switch.
The briefing demo made the mechanism concrete. An administrator set a $25 limit on a refunds agent. A customer requesting an $18 refund sailed through automatically. A $40 request was blocked from automatic execution. The agent kept access to the systems it needed without the organization fearing unlimited refunds, because the credential itself carried the boundary.
The dimmer switch, not the kill switch
The most quotable moment of the briefing came from Nenshad Bardoliwalla, Senior Vice President of AI Products at ServiceNow, who argued that the hotly debated kill switch only becomes useful when there is a baseline against which to judge an agent's behavior:
"You don't want a kill switch that takes all your systems offline, you want one that can identify an agent that is acting outside of its authorized role and turn it off... Real governance is graduated. It's more like a dimmer switch. You monitor, you pause, you restrict, and eventually, if necessary, you deactivate."
That framing matters because it mirrors what mature operations teams already know: the first response to a misbehaving agent should be containment, not amputation. A binary off switch is a tool of last resort, and an expensive one. The graduated ladder, monitor, pause, restrict, deactivate, matches the way incident response works for every other class of production system.
NVIDIA is ServiceNow's first launch partner, connecting the business context and policies of the Control Tower with enforcement through NVIDIA's Open Agent Safety Platform. Availability for AI Passport, along with shadow AI detection and AI cost management, is expected in Q4 2026.
The identity provider tension
The competitive subtext of the announcement is the collision between platform vendors and identity providers. AI Passport brings ServiceNow closer to what identity vendors like Okta, its partner at the same time, do. When diginomica asked why a buyer should deploy Passport through ServiceNow rather than an identity provider, Bardoliwalla's answer was the portfolio argument: the amplified value of combining discovery, observability, governance and compliance, security, and cost and value measurement in one platform, in his words the only product bringing all five pieces together holistically.
The sharper explanation is the data one: it only works because of what customers have already modeled in ServiceNow, the business services, policies, and assets connected through one central graph. Your authorization system is only as smart as its picture of your business. Notably, ServiceNow confirmed Passport is not based on Veza and uses open specifications that allow other governance products, identity providers, and enforcement points to issue and verify credentials, which leaves room for the identity partnerships to persist anyway.
The regulation sitting behind this
The timing is not accidental. As we covered in the EU opening its first AI Act enforcement case, regulators have begun demanding exactly what products like AI Passport generate as a byproduct: security procedures, external evaluations, and deployment monitoring, with verifiable records of what each deployed agent was allowed to do. An authorization credential with a signed scope is close to a compliance artifact. Enterprises that build the discipline before the mandate will find the mandate trivial when it arrives.
The pattern every deployer can copy
Ignore the enterprise logos and the pattern is portable to any team running agents:
- Write a scope statement per agent. What systems, what actions, what spending limits, what data. One page. Signed off by a human owner.
- Bind the scope to something checkable like a path or tool permission. Cite it automatically at runtime rather than trusting configuration memory.
- Define the graduated response tree before launch. Who monitors, who can pause, what restriction looks like, and when deactivation happens.
- Enforce dollar and count limits where possible. The $25 refund cap is the whole demo in one number, and a limit like that needs no enterprise platform to be useful.
- Keep the log. Every verification, every block, every pause: auditable after the fact.
Sixty percent of that list is documentation, and documentation is why the gap between 79% running agents and 2% secured, the one SailPoint measured, exists in the first place. Platforms will keep productizing the plumbing. The judgment about what each agent should be allowed to do stays human, and it stays yours.
