ServiceNow Is Giving Every AI Agent a Passport. Most Startups' Agents Don't Even Have a Name
By Surya Pratap
October 18, 2026
8 min read
AI & Technology
October 18, 2026
8 min read
Name, owner, scopeHover to exploreAsk a startup that runs AI agents three questions: how many agents do you have, who is responsible for each one, and what is each one allowed to touch? The honest answer is often "several", "the engineering team" and "whatever the API key allows". ServiceNow's announcement this week is a sign that large customers are about to stop accepting that answer.
This article is based on ServiceNow's announcement of 15 October 2026, and on coverage by Constellation Research and Forkast. AI Passport is not yet available, and the figures quoted come from ServiceNow and its customers. The reading from section 3 onward is mine.
AI Passport is, in ServiceNow's words, "a cryptographically signed credential that AI agents refer to at runtime to verify their authorized scope". Each agent's credential records:
The check happens when the agent acts, not only when it is set up. An agent working within its scope runs freely. One that drifts gets a graduated response: "redirecting, restricting, or reconnecting the AI agent with proper context — including kill switch capabilities at machine speed if termination is needed."
Three other details matter:
ServiceNow quoted two figures, both from its own research or customers:
The second one is the more useful. A large customer has decided that an agent is managed like a member of staff: it has an identifier, and someone is answerable for what it does.
When your customer gives each of its 1,500 agents an employee ID and a manager, the agent you sell them will be asked for the same.
You probably will not buy AI Passport. But if you sell AI agents to companies, your agents will run inside customers that are adopting this kind of control, and their security reviews will start asking about it:
The pressure is coming from several directions at once. The FTC has just asked OpenAI and Anthropic for their incident records and safeguards. Surveys keep finding that companies are more confident in their agent controls than their controls justify. A credential per agent is the kind of control that can be shown, not just described.
You do not need signed credentials or an enforcement platform to answer those four questions. You need a few deliberate pieces.
An agent registry. One row per agent, four columns: agent ID, owner (a person, not a team), allowed actions, and systems it can reach. Keep it in your repo and review it when an agent changes. If an agent is not in the table, it should not be running.
A credential per agent. Stop sharing one API key across agents. Give each agent its own short-lived token, scoped to the actions and systems in its row. When one misbehaves, you can revoke it without breaking the others.
Check at the action, not in the prompt. "Only read invoices" in a system prompt is a request. A tool layer that refuses the call is a control. Put the permission check where the agent's action actually executes.
A graduated off switch. Alert first, then throttle, then block, then stop — per agent. Decide in advance which behaviour triggers which step, and test the kill switch before a customer asks whether you have one.
Log by agent, not by user
Make the agent ID part of every log line, alongside the human user it acts for. "User 4812 deleted 300 records" and "Agent billing-reconciler, acting for user 4812, deleted 300 records" lead to very different conversations — with your customer, and with anyone investigating afterwards.
Why enforce outside the model? When the UK AI Security Institute tested an OpenAI agent with a one-line scope rule, unsanctioned actions fell sharply but not to zero. A written scope helps; an enforced one is what holds. And the registry and the named owner are the parts no framework gives you.
That AI Passport works as described. It is not available until Q4 2026, and nobody outside ServiceNow and its partners has tested it.
That the open specifications are settled. ServiceNow says the credential is built on open specifications but its announcement does not name them, and interoperability depends on other vendors adopting the same ones.
That a credential makes an agent safe. As Forkast points out, enforcement is only as good as the scope written into the credential. A badly scoped passport gives a false sense of control.
That the banking figure describes your customers. The 24% figure is from ServiceNow's own survey of banks, a heavily regulated sector.
ServiceNow's AI Passport gives each AI agent a signed credential stating its identity, permitted actions, reachable systems and accountable owner, checked at the moment it acts, with responses up to a kill switch when it drifts. It ships in Q4 2026 with NVIDIA as launch partner, on open specifications that are not yet named. One customer already gives each of its 1,500 agents an employee ID and a manager.
For startups the product matters less than the expectation it sets. Enterprise buyers will ask what each of your agents is, who owns it and what it can do, and will want the answer enforced in code.
Before your next enterprise deal, write the registry: every agent you run, its owner, its allowed actions and its systems. Then give each agent its own credential and put its ID in every log line.
Sources: ServiceNow, 15 October 2026 — the definition of AI Passport, the graduated responses and kill switch, the open-specifications statement, NVIDIA's role and the OpenShell and Sentry components, Q4 2026 availability, the 2026 Banking AI Maturity Index figures and LTM's 1,500 agents with employee IDs and managers. Constellation Research — coverage of the NVIDIA Open Agent Safety Platform partnership. Forkast — the observation that enforcement depends on how carefully the credential is scoped. The reading in sections 3 to 5 is mine.
IdeaToMVP Academy
4-week live cohort for founders. Learn to ship AI agents, scope MVPs, and automate your business — taught by the same team that writes these guides.
