ServiceNow AI Passport: Make Agent Authority Expire

What ServiceNow announced

AI Passport is designed to issue each first- or third-party agent a signed credential grounded in enterprise context such as configuration records, governance policies and workflow approvals. ServiceNow says enforcement points can verify the credential at each step, narrow delegated authority and revoke access precisely when an agent drifts outside scope. NVIDIA is a design and launch partner for an implementation using its Open Agent Safety Platform. [1]

The announcement also covers shadow-AI detection, access mapping, observability and cost governance. ServiceNow says AI Passport, shadow-AI detection and AI Cost Management are expected in Q4 2026. Those are forward-looking product plans, not evidence that every stated capability is generally available or effective in a customer's environment. [1]

A credential is only as good as its authority model

A passport can make an agent's authority portable and machine-verifiable, but signing weak permissions only preserves weak permissions. The issuer still needs trustworthy source data, an accountable owner and an enforcement point that refuses invalid, expired or over-broad requests. A credential should never let a model expand its own authority.

The current Model Context Protocol authorisation specification separates a client from the resource server and requires protected servers to enforce access to their resources. That boundary matters for agent systems: the model may propose an action, but a policy-controlled service should decide whether the requested tool, resource and operation are allowed. [2]

Use a six-field agent passport record

Before adopting any credential format, define the business record it must carry or reference. Six fields create a practical minimum:

• Owner and issuer: identify the accountable business owner, technical operator and credential authority.
• Approved purpose: state the bounded outcome the agent may pursue and the decisions it must not make.
• Data, tool and action scope: list permitted systems, records, operations and transaction limits.
• Delegation limits: specify which agents may receive narrower authority, for how long and with what evidence.
• Expiry and renewal: use short-lived credentials, require current policy at renewal and avoid silent permanence.
• Revocation and evidence: define the kill path, response time, audit record and recovery test.

Pilot revocation before production

Choose one low-consequence workflow and test four failure modes: an expired credential, an unapproved tool, a delegated request wider than the parent scope and an emergency revocation during execution. Confirm that access is denied at the enforcement point, not merely logged after the action. Measure false approvals, false denials, time to revoke and completeness of the evidence trail.

Procurement should ask whether the credential is open, who can issue and verify it, how keys rotate, whether third-party agents can be constrained independently and how the organisation exits without losing its authority history. ELYMENT AI helps teams connect owners, approvals, execution evidence and recovery actions so agent autonomy stays bounded as workflows become more complex.

Sources

• ServiceNow Newsroom: AI Passport and expanded governance capabilities (2026-10-15) - First-party announcement covering the credential model, runtime enforcement claims, launch partnership and expected availability.
• Model Context Protocol: Authorization (2026-07-28) - Primary technical specification for authorisation roles and protected resource enforcement in MCP.

Continue learning

• Control model access before requests reach production
• Pilot an enterprise agent control plane
• Keep a named principal accountable for agent actions

Frequently asked questions