AI Governance Institute
← News
Corporate Policy2026-10-18

ServiceNow AI Passport Ties Agent Identity to Business Context at Runtime

Source

ServiceNow gives AI agents a passport, and limits on what they can do

ServiceNow

Via ServiceNow

What happened

ServiceNow has launched AI Passport, described in ServiceNow gives AI agents a passport, and limits on what they can do as a cryptographically signed credential. It verifies what an AI agent is authorized to do at the moment it acts, not just when it logs in. The credential carries the agent's approved scope, including which systems it may access and what actions it may take. That scope is checked continuously as the agent moves through multi-agent workflows and Model Context Protocol (MCP) environments. MCP is an open protocol that lets AI agents connect to external tools and data sources; without controls at that layer, an agent can quietly exceed its original permissions. The launch follows a documented pattern of authorization failures in agentic deployments, including 253 MCP Server Bugs and Six Framework Bypasses Expose Agent Authorization Gap. It also follows the finding that 55% of Organizations Run System-Changing AI Agents Without Identity Controls. The product reflects a shift that researchers and practitioners have named explicitly: governance over agents must move from setup-time configuration to continuous, per-action authorization.

Why it matters

  • ·Regulators and auditors increasingly expect organizations to show not just that agent permissions were set correctly at deployment, but that those permissions were enforced at every action step. A runtime credential approach makes that evidence producible, which matters for EU AI Act (Regulation (EU) 2024/1689) conformity assessments and financial regulators examining agentic AI deployments.
  • ·The identity-at-runtime model directly addresses the control gap documented across MCP environments. Agents can acquire access to systems or data far beyond their intended scope once live. Organizations already using ServiceNow workflows or MCP-connected agents face immediate procurement and configuration decisions if they lack equivalent controls today.
  • ·Because AI Passport is a vendor product rather than an open standard, procurement teams must evaluate several factors. These include whether its authorization model integrates with existing access governance systems, what audit log format it produces, and whether those logs meet the organization's incident response and regulatory reporting requirements.

Stay ahead of stories like this

Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

AGT-001Agent Permission BoundariesAGT-009Agent and Non-Human Identity ManagementAGT-006Agent Action Audit TrailAGT-025Agent Access Entitlement Runtime Re-ValidationAGT-030MCP Server Inventory and Configuration Baseline

What to do now

  • ☐Ask your engineering or IT team to list every AI agent currently running in your environment and confirm whether each one has a distinct identity credential that records what it is authorized to do, separate from general user credentials.
  • ☐For any agent connected to MCP servers or multi-agent workflows, verify that authorization is checked at each action step, not just at startup; request evidence of how the current system would prove this to an auditor.
  • ☐If you are evaluating ServiceNow AI Passport or a comparable product, require the vendor to demonstrate what audit log records are generated for each agent action and confirm those logs can be exported into your existing log management or compliance reporting system.
  • ☐Review your agent procurement checklist to add a specific requirement: vendors must document how their products enforce and record per-action authorization boundaries, not merely initial access controls.
  • ☐Confirm with your legal and compliance team whether your current incident response plan covers scenarios where an AI agent exceeded its authorized scope, and update the plan if runtime authorization evidence is not yet part of the required record.

What to watch next

The market for runtime agent authorization products is forming quickly, and ServiceNow's named entry is likely to prompt comparable announcements from other enterprise platform vendors. Compliance teams should watch whether these products align with emerging standards from bodies such as the International Telecommunication Union's focus group on trust and identity for agentic AI. They should also watch whether regulators begin to treat runtime credential evidence as an expected audit artifact. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services has already named identity and scope controls as a baseline expectation. Enforcement-minded regulators in financial services and healthcare may begin referencing that framing when reviewing incidents involving agents that exceeded intended access.

Related Coverage

Corporate Policy2026-11-02

Azure Telemetry Confirms Prompt Injection as the Top Agent Attack. Accountability Is the Fix.

Jones Walker published guidance drawing on Azure AI workload telemetry. It found that malicious instructions injected through model and tool outputs are the most common observed attack against enterprise AI agents. The article recommends that every deployed agent carry a named human sponsor, auditable identity metadata, and time-limited access rights. It also calls for recertification whenever a material aspect of the agent changes.

Corporate Policy2026-10-29

Microsoft CISO Guidance Makes Agent Identity and Observability the Enterprise Baseline

Microsoft has published guidance for enterprise security leaders on governing AI agents in production environments. It calls for assigning agents their own managed identities and limiting their access to only what each task requires. Security teams must maintain continuous visibility over what each agent owns, can reach, and has done. It directly affects identity management, access controls, audit logging, and incident response programs.

Research2026-11-06

NSA Names Tool Poisoning and Weak Credentials as Core MCP Security Risks

The NSA has published a cybersecurity information sheet on Model Context Protocol (MCP) systems. MCP is the connective layer that lets AI agents use external tools and data. The guidance names tool poisoning, weak authentication, missing approval workflows, and absent audit logs as the primary failure points. Enterprise teams are directed to inventory every MCP server, use short-lived scoped credentials, sandbox servers, and log each tool invocation with agent and user identities.