Executive Summary
ServiceNow has announced AI Passport, a cryptographically signed credential that every AI agent and MCP server must present at runtime. The scope is not self-declared. It is issued by ServiceNow and grounded in the customer’s own configuration database, risk policy, and workflow approvals. NVIDIA is the design and launch partner, and it is supplying the enforcement half.
The interesting move is where the control lives. ServiceNow is not asking an agent to respect a policy. It is asking the agent to prove a signed scope before it acts, then enforcing that scope in software outside the agent process and, on NVIDIA hardware, in silicon on the data processing unit. Availability is the catch. AI Passport, shadow AI detection, and AI cost management are all slated for the fourth quarter, so most of this is a promise today.
ServiceNow built a governance framework for agents and then decided the framework was the wrong layer. Its new product, AI Passport, hands each agent a cryptographically signed credential and checks that credential at runtime, at every step of a workflow. The agent does not get to say what it is allowed to do. It has to present proof.
The scope inside a passport comes from systems the enterprise already trusts. ServiceNow issues it from its Super Intelligence Control Tower, grounded in the configuration management database, governance and risk policies, and active workflow approvals. When a primary agent hands work to a second or a third-party agent, the passport narrows the permissions at each hop. A downstream bot cannot hold a wider scope than the task it inherited.
The credential is the product, not the policy
Most agent governance ships as a policy layer that agents are expected to follow. AI Passport flips that. The credential becomes the enforcement point. If an agent stays inside its signed scope, it runs untouched. When it drifts, ServiceNow describes graduated responses, from redirecting the agent and restricting its access to reconnecting it with the right context, up to a kill switch at machine speed. Every step is logged with a compliance signature.
The design is built on open specifications, so an identity provider or a governance tool can issue and verify a passport, including for third-party agents. That matters, because the alternative is a proprietary checkpoint that every agent call has to route through. The company says a third-party agent now carries a verifiable permissions record instead of its own claims about what it can do.
NVIDIA moves enforcement into the DPU and out of the agent’s reach
ServiceNow named NVIDIA as its design and launch partner, and NVIDIA is shipping the enforcer. OpenShell is an open-source runtime that sets a boundary around agents. The important detail is where the policy runs. NVIDIA says OpenShell enforces outside the agent process, so an agent cannot bypass a check by changing its own behavior or its own code.
The second layer is hardware. NVIDIA Sentry runs on BlueField-4 data processing units and watches agent activity out of band. In an NVIDIA Vera Rubin system, each compute tray carries a BlueField-4 unit on the node’s path to the model. From there Sentry can quarantine an agent that moves outside its boundary in milliseconds, and it keeps working even if the host is compromised. NVIDIA says OpenShell does not need the unit, so the software boundary is the floor and the silicon boundary is the upgrade.
Open specifications are the part to test first
The claim to interrogate is open specifications. If AI Passport really is an open credential, then Microsoft Entra, Okta, or an existing API gateway should be able to verify and revoke it without routing every call through ServiceNow. Ask for the schema. If the only verifier is the vendor that issued the credential, the open claim is marketing.
The timing is the second thing to weigh. ServiceNow says AI Passport, shadow AI detection, and AI cost management arrive in the fourth quarter, and only the operational resilience product for financial services is available today. That is a plan, not a shipping product. Meanwhile open source is moving on the same problem, which is the strongest argument that the problem is real.
MCP is where the attack surface sits. Every tool an agent can call is a permission an agent can abuse. Three questions to carry into any agent governance decision. Can your identity provider verify and revoke the credential without the issuer in the loop. Does the enforcement run outside the agent process, where the agent cannot edit it. And when an agent drifts, what is the time from misbehavior to quarantine.
Related reading. Nvidia is paying researchers to attack the agent sandbox it built. And NVIDIA Run:ai going open source was the same bet on owning the runtime.
Get the next one before it is old news
Independent analysis of cloud-native infrastructure, Kubernetes and data center economics. No vendor spin.