ServiceNow announced AI Passport on October 15. The product issues cryptographically signed credentials that define what an AI agent is authorized to do. The credential is checked at runtime. If an agent tries to do something outside its scope, the system can redirect it or restrict it. It can also shut the agent down. The credential is built on open specifications so third parties can issue their own. ServiceNow expects it to ship in Q4 2026.
The estimating tool calls an API to score bids. Atelier routes requests to seven model providers. The flight planner queries weather data. Curbscript generates service routes through an API. Each call sends a request and receives a response. The API documentation lists endpoints, required headers and response schemas. It does not list a credential that verifies what the model is authorized to do. The credential does not exist while the call runs.
The scope is in the passport not the token
AI Passport defines an agent's identity, permitted actions, accessible systems and accountable owner. The credential is cryptographically signed. The signature binds the agent to its authorization. A system that checks the credential at runtime can verify what the agent is allowed to access. The check happens before the agent acts. The model APIs I call today do not provide that credential. They provide a bearer token that grants access to the API. The token does not describe what the model is authorized to do. The data it receives stays outside the token's scope.
The construction ERP calls an API to parse invoices. The permit app calls an API to interpret zoning codes. The dating-profile tool runs inference on a Cloudflare Worker. Each call includes an API key or a bearer token. The token proves I paid for access. It does not prove that the model acting on my behalf is authorized to access the data. The specific invoice, the specific zoning file, or the specific profile falls outside the token's scope. What the model does with the call stays undocumented.
The verification happens before the action
AI Passport checks authorization at runtime. The check happens before the agent acts. An audit trail shows what happened after the fact. A runtime check stops the action before it completes. The provider can redirect the agent, restrict its access, or terminate the session. The model APIs I call return a response that may include an unauthorized action. That event goes unmentioned by the API.
The jewelry site processes orders. The dog-training site runs review gates. The payroll system handles tax filings. Each platform calls APIs that accept structured input and return structured output. The output may be correct or wrong. It may include an action the model attempted without my authorization. The API does not verify scope at runtime. It verifies that I hold a valid key. The key grants access to the endpoint. It does not grant the model permission to access the data the endpoint returns.
The passport said what it could do.
ServiceNow reports that 100 percent of banks use AI. Only 24 percent have governance to match. AI Passport ships a governance layer. The credential binds an agent to its authorized scope. The binding is cryptographic. A system that checks the credential at runtime can verify the agent's authority before it acts. The model APIs I call today do not check a credential at runtime. They check a key at request time. The key proves I paid. The credential would prove the model is authorized to act.