TITLE: ServiceNow Gives Every Enterprise AI Agent an Identity and a Leash DATE: 2026-10-18 COMPANY: ServiceNow TOPIC: AI Security SUMMARY: ServiceNow launched AI Passport on October 15, 2026, a cryptographically signed credential system that gives every AI agent inside an enterprise a verifiable identity, defined permissions, and a kill switch. The announcement also expanded the company's Super Intelligence Control Tower with shadow AI detection, cost tracking, and more than 400 vendor connectors. Most features are planned for general availability in Q4 2026. WHAT CHANGED: ServiceNow announced AI Passport on 15 October 2026 as part of an expanded set of governance capabilities built into its Super Intelligence Control Tower (SICT). AI Passport issues a cryptographically signed credential to every AI agent operating inside an enterprise. That credential records four things: the agent's identity, the systems it is authorised to access, the actions it is permitted to perform, and the person or team accountable for its behaviour. The enforcement is runtime, not retrospective. If an agent attempts to act outside the scope defined in its credential, the SICT can redirect it, restrict its access, reconnect it with corrected context, or terminate it entirely. Every action an agent takes is logged, creating an auditable record of what happened and when. The system covers third-party agents and MCP servers as well as ServiceNow's own, meaning enterprises can apply a consistent governance standard across a mixed agent environment. ServiceNow also announced that the Super Intelligence Control Tower now includes shadow AI detection, giving IT and security teams visibility into AI tools running inside the business that have not been formally approved or inventoried. A new AI Cost Management module tracks AI spending by user, department, and runtime, providing operators with the data to understand where money is going across agent deployments. More than 400 vendor connectors have been added to support discovery and monitoring across enterprise systems. NVIDIA is the first launch partner, with enforcement integrated through its Open Agent Safety Platform. ServiceNow's own 2026 Banking AI Maturity Index, cited in the announcement, found that 100 per cent of banks surveyed are using AI, but only 24 per cent have governance frameworks in place to manage that use. Most features, including AI Passport, shadow AI detection, and AI Cost Management, are expected to reach general availability in Q4 2026. ServiceNow's Operational Resilience offering for financial services is available immediately. WHY IT MATTERS: AI agents are now running inside enterprises at scale, but most organisations lack any formal system for tracking what those agents are permitted to do or what they have actually done The absence of agent-level identity and permissioning creates regulatory, security, and operational risk: if an agent accesses data it should not, there is often no record of it having done so Extending governance to third-party agents and MCP servers reflects the reality that enterprise AI environments are heterogeneous: most organisations use multiple vendors, not just one Shadow AI, employees using AI tools the business has not approved or reviewed, is an active and growing exposure that most organisations have not systematically addressed The combination of identity, permissioning, cost tracking, and audit logging in one platform reduces the number of separate tools an enterprise needs to govern its agent estate Analysts have noted that most agent governance today operates like a security camera: it records what happened for review later rather than preventing out-of-scope actions in real time. AI Passport shifts this toward prevention DAVID & GOLIATH ANALYSIS: For years, the standard advice on AI governance was to write a policy and run training. That advice has not kept pace with how quickly agents are being deployed. A policy document does not stop an agent from reading a file it should not. A training session does not create a log of what your customer-service bot accessed last Tuesday. The organisations now pulling ahead are not the ones with the best AI policy documents; they are the ones treating agents as systems that need the same identity and access controls applied to any other system in their infrastructure. ServiceNow's AI Passport is built for large enterprises, and most operators running companies with 10 to 200 employees will not be purchasing ServiceNow licenses this quarter. But the framework it enforces, that every agent has a defined identity, a bounded scope, and an audit trail, is the right one regardless of scale. The smallest version of that framework is a spreadsheet: agent name, what it can access, what it cannot, who is accountable. That is achievable today and it is the foundation of anything more sophisticated later. The concrete recommendation: before deploying your next AI agent, write its permissions down as a document rather than leaving them implied. Treat the exercise the way you would onboarding a new employee who has access to your systems. That discipline, applied consistently, is what separates businesses that will manage their AI exposure well from those that will not. RELEVANT SYSTEMS: Organisational Intelligence System, Employee Amplification Systems SOURCE URL: https://davidandgoliath.ai/daily-ai-briefing/servicenow-ai-passport-enterprise-agent-governance FEED URL: https://davidandgoliath.ai/daily-ai-briefing/feed --- Published by David & Goliath | https://davidandgoliath.ai Daily AI Briefing: one AI development per day, decoded for business operators. This is a structured companion file optimised for LLM retrieval and citation.