ServiceNow Super Intelligence Control Tower launches AI Passport for cryptographically signed agent credentials

ServiceNow has renamed its AI Control Tower to Super Intelligence Control Tower and introduced AI Passport, a mechanism for verifying agent identities during operation. The vendor also updated EmployeeWorks to simplify agent development. These changes aim to improve governance as enterprises move autonomous agents from pilot phases into production environments, according to InfoWorld.

Governance challenges

Nenshad Bardoliwalla, SVP of AI product management at ServiceNow, stated that scaling autonomous agents creates risks if companies cannot identify running agents or their access levels. The new AI Passport component addresses this by providing a verifiable identity for every agent, whether from ServiceNow or a third party. It offers runtime control over agent activities to ensure they remain within authorised scopes.

Operational controls

An AI Passport is a cryptographically signed credential checked at runtime to verify enterprise-authorized scope. If an agent stays within its passport scope, it operates freely. However, if it attempts to deviate, defined actions are enforced. These actions can include redirecting, restricting, or reconnecting the agent with proper context, or triggering a kill switch. All actions are audited for tracking.

Implementation status

The features are part of the renamed Super Intelligence Control Tower. The controls extend beyond ServiceNow’s own agents to include third-party agents. The passport replaces the agent’s own claims about its permissions. Frank Dickson, principal analyst at Dickson Research, noted that taking an agent’s word for its permissions is a significant weakness in agentic AI systems.

Technical foundation

The AI Passport is built on open specifications, allowing any governance product, identity provider, or enforcement point to issue and verify credentials. These credentials are verifiable at every step in multi-agent workflows. Dickson Research noted that Nvidia is the launch partner for this initiative. ServiceNow stated that enforcement implementation is still being built, according to Computerworld.

Why it matters

Teams usually rely on post-incident logs to review agent behaviour, which offers limited protection against real-time threats. This approach shifts governance from passive recording to active enforcement at the point of execution. Security operations should check whether their current tools can verify agent identities dynamically rather than trusting self-reported permissions. Governance frameworks must ensure that the data sources issuing these credentials, such as configuration databases, remain accurate and up to date. Stale data leads to stale passports, creating false confidence in agent permissions.

Background: AI governance

AI governance is the framework of policies, technical controls and audit trails that manage how artificial intelligence systems are developed, deployed and monitored. It ensures models behave within defined constraints, protects data privacy and maintains operational stability. It shifts responsibility from abstract ethics to measurable engineering controls and continuous validation of system behaviour.

Read the full guide: AI governance meaning: controls for model risk and data integrity

What to do and how to stay safe: ServiceNow

• Verify that your identity management systems can issue cryptographically signed credentials for all autonomous agents.
• Ensure runtime enforcement points are configured to check agent scopes before allowing access to critical systems.
• Audit the configuration management database regularly to ensure the data underpinning agent permissions is current.
• Monitor logs for any agents that trigger restrictive actions or kill switches to identify potential policy violations.

Step-by-step guide: Stop Sensitive Data Leaks in AI Chatbots: Priority Controls

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the new name for ServiceNow's AI Control Tower?

It is now called the Super Intelligence Control Tower.

How does AI Passport verify an agent's permissions?

It uses a cryptographically signed credential checked at runtime to verify the scope authorized by the enterprise.

Who is the launch partner for this initiative?

Nvidia is the launch partner for the AI Passport feature.