Summary

  • ServiceNow announced AI Passport on 15 October as a signed credential for its own and third-party agents, with runtime scope verification; it expects availability in the fourth quarter of 2026.
  • The open v1 draft published on 22 October records business context and identity bindings. Its companion revocation check can stop a whole agent. The draft leaves action-specific permission rules to the system receiving the agent.

The passport and the permission desk

A passport at a border proves who has arrived. It does not book a meeting in the minister's office. ServiceNow's proposed AI Passport faces the same separation: a signed record can identify an agent, its owner and its business purpose, while the organisation admitting it still has to decide what that agent may do.

In its 15 October announcement, ServiceNow describes cryptographically signed credentials for first- and third-party agents and runtime verification of scope. It says the product is expected in Q4 2026. That is a product promise with a date ahead of us. The public v1 draft, fixed here at its 22 October revision, describes a narrower common language: issuer, subject, owner or manager, organisational unit, vendor, risk classification, purpose, authenticated identity bindings and a revocation address. It explicitly says this document specifies no policy; constraints describing what an asset may do are planned for a later release.

The verifier must authenticate the presenting agent separately, match that identity to a binding, check signature and validity, then ask whether the credential has been revoked. The companion revocation draft calls its answer a withdrawal signal, never an authorization grant. Its v1 rule covers the whole subject. Although the response has a revoked_scopes field, v1 registers no entry type and a v1 responder sends an empty array. A failed check makes the caller deny, and cache rules bound how long an answer can be reused.

That split changes the buying question. A buyer can use the open format without treating the format as a ServiceNow monopoly: the project README offers royalty-free implementation. Yet an issuer still has to map an agent to a real owner and enterprise record; a gateway still has to decide whether this agent may read a customer file, send a payment or alter a ticket; and a revocation service has to answer when a credential loses its standing. ServiceNow is building an issuer against its own enterprise data and workflow estate. The economic prize lies in making that chain the everyday permission desk.

An open passport can ease interchange. It cannot resolve the local policy argument by itself. The test for any deployment is a concrete action: show the agent, the record it wants, the rule that admits or rejects it, and how quickly a withdrawal reaches that rule. Without that trail, the market is buying a better identity card while the power to open doors remains elsewhere.

Sources