ServiceNow AI Passport aims to verify what AI agents may do
ServiceNow introduces signed authority for agents and MCP servers. What AI Passport promises, when it may ship, and what enterprises should test.
On October 15, ServiceNow introduced AI Passport, a cryptographically signed authority credential for first- and third-party AI agents and MCP servers. The proposed mechanism verifies permitted actions at runtime, instead of trusting an agent's claims. ServiceNow expects availability in Q4 2026; this is an announcement, not evidence of broad production deployment.
Enterprises could inventory agents and review execution logs, but that alone did not establish a verifiable, cross-platform permission scope for each action as it happened.
AI Passport is intended to bind agent actions to verifiable authority, supporting graduated responses such as restriction, reconnection or termination. Availability is expected in Q4 2026.
An authority credential, not just another agent label
ServiceNow's announcement asks a practical question: is this particular agent authorized to take this particular step in this business process? AI Passport is described as a cryptographically signed credential that enforcement points can verify during execution. Rather than treating an agent's self-description as proof, the control plane would match a requested action against the authority granted to that agent. Delegation can then be scoped more narrowly as work passes through a multi-agent workflow.
The proposed authority is grounded in ServiceNow's Configuration Management Database, governance and compliance policies, and workflow approvals. ServiceNow says the approach is designed for its own agents as well as third-party agents and MCP servers. That is an architectural commitment in the announcement, not independently established interoperability with every vendor. Adoption will depend on where credentials are issued, who checks signatures, and whether an out-of-scope tool call is genuinely blocked.
Why a runtime check changes the governance conversation
ServiceNow is also expanding the Super Intelligence Control Tower to discover AI assets, map entitlements and connect observed behavior to cost and business outcomes. The company describes shadow-agent detection, execution traces and graduated responses ranging from throttling to a kill switch. It refers to more than 400 out-of-box connectors intended to support AI discovery across products and providers, not proof that every connector or control is deployed today.
NVIDIA is identified as a design and launch partner. The intended enforcement architecture includes the NVIDIA Open Agent Safety Platform, OpenShell secure runtime software and Sentry security tools. Such a runtime boundary matters because real agents can chain models, remote tools and business systems. Still, a signed passport cannot by itself prevent prompt injection, badly written policies or compromised credentials. Authorization, sandboxing and independent behavior evaluation remain separate layers.
Availability and a realistic enterprise test plan
The press release separates product timelines. AI Passport, shadow-AI detection and AI Cost Management are expected in the fourth quarter of 2026. ServiceNow says its Operational Resilience solution for financial services is already available. Treating every capability in the release as generally available would be misleading. The source does not establish a universal price or independently verified compatibility with every competing agent platform.
A sensible pilot would test an allowed action, a deliberately out-of-scope request, and credential revocation during a running workflow. Teams should record who signs the credential, whether the MCP or tool endpoint validates it, and what evidence remains after an action is rejected. They should also exercise the failure mode: what happens if the authority service cannot be reached? These are editorial test recommendations, not results of AgentenCode hands-on testing.
AgentenCode assessment
The potentially important shift is from observing agent behavior after the fact to enforcing authority at the moment of action. The term Passport is less meaningful than the measurable question of whether a cross-vendor tool call is stopped when scope is missing or revoked. ServiceNow has announced an approach; real deployment quality and Q4 delivery still need verification.
Sources and verification
Source-scoped editorial review of ServiceNow's October 15, 2026 announcement. Timelines and capabilities are vendor claims; no independent implementation or compatibility test.