{"slug": "servicenow-bets-the-credential-is-the-governance-layer-not-the-policy", "title": "ServiceNow Bets the Credential Is the Governance Layer, Not the Policy", "summary": "ServiceNow announced AI Passport on October 15, 2026, a governance system that uses cryptographically signed credentials to gate what AI agents can do at runtime, built with NVIDIA's Open Agent Safety Platform, OpenShell runtime software, and Sentry security framework. ServiceNow cited a vendor-reported 2026 Banking AI Maturity Index showing 100% of banks use AI but only 24% have matching governance capabilities, and a Futurum SLE Decision Maker Survey finding just 45.1% of organizations have basic audit logging for AI agent actions. AI Passport, shadow AI detection with more than 400 out-of-box connectors, AI Cost Management, and AI Agent Studio are expected to be available in Q4 2026.", "body_md": "ServiceNow is shifting its approach to [agentic AI](https://forkast.news/glossary/agentic-ai/) governance, moving beyond the framework of governed autonomy introduced in [AI Workflow Factory](https://forkast.news/servicenow-launches-ai-workflow-factory-and-autonomous-engineer-to-close-the-execution-gap/). On October 15, 2026, the company [announced AI Passport](https://newsroom.servicenow.com/press-releases/details/2026/ServiceNow-advances-its-operational-harness-for-enterprise-AI-with-AI-Passport-and-expanded-governance-capabilities/default.aspx), a system that uses cryptographically signed credentials to gate what AI agents can do at runtime. While the earlier AI Workflow Factory focused on identifying and executing workflows, AI Passport introduces a structural change: the credential itself is the product, not just a layer of policy.\n\nIn most current enterprise setups, governance relies on policy layers that agents are expected to follow. AI Passport flips this model. By using cryptographically signed credentials, the system requires agents to present proof of their identity and capability attestation before they can act. This means the agent does not simply claim what it is allowed to do; it provides a verifiable record of its permissions. This shift is intended to provide enterprises with control over both first- and third-party agents, as well as [MCP servers](https://forkast.news/glossary/model-context-protocol-mcp/), at every step of a multi-agent workflow.\n\nAccording to a vendor-reported 2026 Banking AI Maturity Index, while 100% of banks are using AI, only 24% possess the governance capabilities to match that adoption. Furthermore, a [Futurum](https://futurumgroup.com/insights/servicenows-ai-passport-closes-the-agentic-governance-gap/) SLE Decision Maker Survey found that fewer than half of organizations (45.1%) have basic audit logging for AI agent actions. Perhaps most telling, a Futurum AI Platforms Decision Maker Survey noted that 7.1% of enterprises now cite cross-agent governance as their single biggest concern — a category that did not even register in previous surveys.\n\nTo build this, ServiceNow partnered with NVIDIA, which contributed its Open Agent Safety Platform, OpenShell runtime software, and the Sentry security framework. This collaboration enables machine-speed enforcement. If an agent attempts an action outside its authorized scope, the system can trigger graduated responses, ranging from redirecting or restricting the agent to a full termination via a kill switch. A practical caveat here is that the effectiveness of this enforcement depends on the granularity of the initial credentialing process.\n\nServiceNow is positioning this as part of a broader expansion of its Super Intelligence Control Tower. Alongside AI Passport, the company is introducing shadow AI detection, which uses more than 400 out-of-box connectors to identify AI tools operating outside of IT oversight. Additionally, AI Cost Management will integrate expenses from frontier models, SaaS AI, hyperscalers, and data center GPUs into a single view. These features, along with AI Agent Studio — which allows employees to build agents with governance embedded by default — are expected to be available in Q4 2026.\n\nThe company is also emphasizing that AI Passport is built on open specifications. This is intended to allow any governance product, identity provider, or enforcement point to issue and verify these credentials, rather than locking users into a proprietary silo. For instance, in a vendor-reported example, Chandan Pani, CISO at LTM Limited, a $5 billion IT services business, noted: “As we accelerate LTM’s growth as an AI-led enterprise, we have deployed 1,500 AI agents across the organization, each assigned an employee ID and manager to ensure accountability, oversight, and continuous improvement.” The open-spec bet is that enterprises will standardize on a shared credential layer rather than fragment across vendor-specific agent identity systems. AI Passport, shadow AI detection, and AI Cost Management are expected in Q4 2026.", "url": "https://wpnews.pro/news/servicenow-bets-the-credential-is-the-governance-layer-not-the-policy", "canonical_source": "https://forkast.news/servicenow-bets-the-credential-is-the-governance-layer-not-the-policy/", "published_at": "2026-10-15 18:37:42+00:00", "updated_at": "2026-10-15 18:56:20.720891+00:00", "lang": "en", "topics": ["ai-agents", "ai-policy", "ai-safety", "ai-products", "agent-protocols"], "entities": ["ServiceNow", "NVIDIA", "AI Passport", "Open Agent Safety Platform", "OpenShell", "Sentry", "Super Intelligence Control Tower", "Chandan Pani"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/servicenow-bets-the-credential-is-the-governance-layer-not-the-policy", "markdown": "https://wpnews.pro/news/servicenow-bets-the-credential-is-the-governance-layer-not-the-policy.md", "text": "https://wpnews.pro/news/servicenow-bets-the-credential-is-the-governance-layer-not-the-policy.txt", "jsonld": "https://wpnews.pro/news/servicenow-bets-the-credential-is-the-governance-layer-not-the-policy.jsonld"}}