ServiceNow gives AI agents a passport, and limits on what they can do

The problem ServiceNow is solving

When you give an AI agent a set of tools, you face a question that sounds simple but isn't: which tools should it be allowed to use, and when?

Think of it like handing someone the key to your flat. They can water the plants, but you probably don't want them rearranging the furniture or lending the key to someone else. With AI agents, the question is sharper: a customer service agent might need to look up an order but shouldn't be able to issue a refund above a certain amount. A legal research agent should read contracts but not approve them.

ServiceNow's new AI Passport is a governance layer that sits between agents and the tools they call ^[1]. It checks, at runtime, whether an agent is authorised to do what it is about to do. If it isn't, the action is blocked.

How AI Passport works

AI Passport integrates with ServiceNow's Now Platform and works with both ServiceNow's own agents and external Model Context Protocol servers ^[1].

The core idea is that each agent gets a passport: a set of permissions that defines what it can and cannot do. When an agent tries to call a tool or access data, AI Passport checks the request against the passport. The check happens before the tool is called, not after.

ServiceNow says the system provides "comprehensive oversight and platform integration" ^[1]. That means you can set rules centrally and see what agents are doing across workflows. It's built for organisations that want agentic AI but need to stay in control of what happens.

What this means for you

If you are building or deploying multi-agent systems, here are three questions AI Passport brings into focus:

• Who decides what each agent can do? Governance starts with deciding who sets the rules. Is it the IT team, the business owner or both? And who changes them when a workflow evolves?
• Can you show what an agent did, and on whose authority? When something goes wrong, or when an auditor asks, you need to know which agent did what and whether it was authorised to do it. AI Passport gives you the rules; you still need the audit trail.
• How do you test the limits? Before you put an agent into production, you need to know it stays within its passport. That means testing not just what the agent should do, but what it should refuse to do.

Where a digital witness fits

AI Passport controls what agents are allowed to do. A digital witness shows what they actually did.

Here, the thing to seal is each action: which agent, which tool, which instruction and which result. Sealing takes a fingerprint of the record, not the data itself, so the action log stays in your systems. When an action is questioned later, anyone you share the record with can check that it hasn't been altered since it was sealed.

Say a customer claims an agent approved a discount your terms don't allow. With a sealed record of what the agent did, you can show what instruction it received, which tool it called and what result it returned. The record is the same one written at the time, provably unchanged.

What a digital witness doesn't do is authorise the action, make it correct or decide whether the agent should have been allowed to do it. That's AI Passport's job. The witness just gives you a checkable record of what happened.

You can seal agent actions through WitniumChain's MCP server, which means the sealing happens as the agent acts. The first 2,000 witnesses a month are free. Read the docs to see how it fits into a workflow.

How it would work

1. Each time an agent calls a tool, your system sends a fingerprint of the action (instruction, tool name, timestamp and result) to WitniumChain.
2. You get a witness ID back and store it with the action record.
3. When the action is questioned, anyone you share the record with calculates the fingerprint again and checks it against the sealed one.

What to watch

AI agents are moving fast from demos to production, and governance is catching up. ServiceNow's AI Passport is one answer to the question of how you keep control when you delegate decisions to agents.

The AI Act's Article 26 will, from 2 December 2027, require users of high-risk AI to monitor the system's operation and keep humans in the loop ^[2]. That doesn't directly mention agents, but if your agents make decisions about people, the monitoring duty applies. A governance layer that blocks unauthorised actions is a good start. A record of what actually happened, sealed as it happens, is the other half.