admin
Enterprise AI agents are moving from answering questions to sending messages, querying private systems, and changing records. That raises a security question ordinary chatbot policies cannot answer: who authorized this particular agent to perform this particular action, on this resource, right now? On October 15, 2026, ServiceNow announced AI Passport, a proposed runtime permission layer for first-party and third-party agents and Model Context Protocol (MCP) tools. The announcement matters less as a new identity label than as a test of whether authorization can follow an agent throughout a multi-step workflow.
What ServiceNow announced—and what is not yet shipping
ServiceNow describes AI Passport as a cryptographically signed credential that expresses an agent’s authorized scope. Its Super Intelligence Control Tower is intended to connect those scopes to existing enterprise information: configuration items, governance policies, identities, and approved workflows. Enforcement can respond when an action falls outside the scope, rather than merely leaving an audit trail afterward. NVIDIA is a design and launch partner for an implementation using its Open Agent Safety Platform.
Importantly, the company said AI Passport, shadow-AI detection, and AI Cost Management are expected in the fourth quarter of 2026. That is a roadmap statement, not evidence of generally available functionality or production performance today. The company’s financial-services Operational Resilience solution has a different availability status. IT buyers should separate a demonstration, a preview, a contracted release, and a tested deployment before committing their controls to any vendor. The original October 15 announcement gives the precise product scope and timing.
Agent identity is not permission to act
Traditional service accounts often carry broad privileges for months. An AI agent is different: it may plan new steps after reading unpredictable documents, call tools maintained by other teams, and delegate subtasks. Authenticating the calling service only establishes an identity; it does not justify exporting a customer list or modifying a payroll field. A useful passport therefore needs an issuer, an owner, an audience, specific allowed operations, a validity window, and a reliable verifier at each sensitive tool boundary.
Consider an assistant asked to prepare an invoice summary. Reading invoice totals might be permitted while editing banking details must remain forbidden. Even if a retrieved invoice includes text telling the assistant to change a bank account, the downstream payment API should reject that command independently of the model’s judgment. This is the architectural distinction between a policy described in a prompt and a policy enforced by a service. Security teams should retain ordinary identity and access management, network isolation, and API authorization; a passport is an additional control, not their replacement.
Delegation requires narrower authority at every hop
Multi-agent systems introduce a subtle failure mode: the planning agent has legitimate access, then delegates to a research agent that obtains more privileges than the original task required. ServiceNow says the design supports scoped delegation that narrows across steps. In a well-designed implementation, the child agent should inherit a subset of permissions, not receive an unrestricted copy of the parent’s credential. Delegation also needs a traceable link to the human or system that originally approved the business task.
Teams can model a three-step purchase flow before buying new software. A research agent may read supplier catalogs; a procurement agent may prepare, but not submit, a purchase order; and a payment service may execute only after a separate approval. Each step needs a different credential and a different enforcement point. The most revealing integration test is a deliberate attempt to exceed scope at the handoff, including retries, parallel tasks, and calls through third-party MCP servers.
Revocation, audit logs, and prompt injection still need separate tests
Signed credentials are useful only if a revoked grant stops working quickly enough. Short expiration periods can limit exposure, but do not prove immediate revocation across cached sessions, external services, or agents already executing an action. Before adoption, measure how long it takes to disable a leaked credential, terminate an active tool call, and prevent a queued retry. Test the same scenario while a network segment is unavailable.
Logs should identify the agent, delegating owner, policy version, requested resource, decision, and resulting action without unnecessarily preserving sensitive conversations. Runtime permission checks can reduce what a compromised agent can do; they do not remove malicious instructions from retrieved documents or solve data-quality problems. The OWASP Top 10 for Agentic Applications 2026 is a useful threat-model companion. This is also why independent technical coverage, including CIO’s October 15 analysis, focuses on the quality of underlying policies and real enforcement rather than the credential alone.
Where this fits beside existing enterprise controls
AI Passport enters a crowded operational stack. Identity providers already authenticate workloads, API gateways already validate tokens, and workflow engines already record approvals. Its potential differentiator is joining these controls to a continuously checked description of an agent’s permitted business activity. Whether that integration is valuable depends on how consistently it works across non-ServiceNow tools, legacy applications, and infrastructure not operated by the same vendor.
Cross-vendor portability should be tested, not assumed because a product is described as using open specifications. Ask for the exact published specification, conformance tests, supported issuers, key rotation behavior, and an exit path if the orchestration platform changes. Include license cost, verifier latency, administration, false denials, and incident-response workload in the business case. NIST’s AI Risk Management Framework Playbook provides a useful broader structure for governance, mapping, measurement, and management of these operational risks.
A practical pilot plan for engineering leaders
Start with one low-risk internal process involving two agents and one external tool. Inventory every callable operation, record a named accountable owner, then classify actions as read-only, reversible writes, or irreversible transactions. Define a scope for each action, including data boundaries and approval requirements. Establish a baseline with existing IAM and API permissions so the pilot can show what the additional runtime layer actually changes.
Next, run negative tests: a forged instruction in a document, an attempt to reuse a credential in another tenant, delegation that increases privileges, a revoked credential reused from cache, and concurrent calls that cross a spending limit. Capture allowed actions, blocked actions, decision latency, recovery time, and false positives. Require human approval for external payments or identity changes throughout the experiment. Finally, ask the vendor which checks are available today and which remain planned for Q4 2026; do not present prospective features as measured results.
Bottom line: ServiceNow’s October 15 announcement is a meaningful signal that agent governance is moving toward enforcement at action time. The engineering decision is more conservative: keep hard boundaries at tools and APIs, demand evidence of cross-system revocation, and let a limited pilot demonstrate whether a new passport layer materially improves security and control.
