Say your company has been using AI agents for six months. Sales has one that follows up with customers. Accounting has another that reconciles statements. IT has connected AI to the ticketing system, and a few employees have signed up for AI tools on their own without telling anyone.
Then an executive asks: how many AI agents do we have, what can each one do, who approved them, and how much did we spend on AI this month? Many organisations cannot answer all four.
This week's ServiceNow announcement goes straight at those questions.
What ServiceNow announced
On 15 October 2026, ServiceNow announced AI Passport and a set of new AI governance capabilities. AI Passport is a cryptographically signed credential issued to each AI agent. Agents and MCP servers check it at runtime to confirm what they are allowed to do.
The credential is issued by what ServiceNow calls the Super Intelligence Control Tower, and it draws on records the organisation already keeps: the configuration management database (CMDB), governance, risk and compliance (GRC) policies, and workflow approvals.
Three details stand out.
- ServiceNow says AI Passport is built on open specifications, so other governance products, identity providers and enforcement points can issue and verify credentials for their own agents and for third-party agents. The release does not name the specifications.
- Delegated permissions narrow at every step. When one agent hands work to another, the receiving agent gets no more authority than the one that delegated it.
- When an agent goes out of scope, the response is graduated: redirect it, restrict it, revoke a specific permission, or shut it down with a kill switch, with an audit trail kept for later review.
NVIDIA is the design and launch partner. The two companies are building an enforcement implementation on the NVIDIA Open Agent Safety Platform, which NVIDIA announced on 28 September 2026.
The tools that come with it
ServiceNow added several other governance capabilities. The ones most relevant to a typical business are these.
- Shadow AI detection finds unapproved AI agents running on the company network.
- More than 400 out-of-box connectors discover AI in use across platforms and vendors.
- Agent behaviour is tracked continuously, and policy can respond in three steps: alert, throttle, block.
- AI Cost Management puts frontier model costs, AI embedded in SaaS, hyperscaler spend and GPU costs in one view, and warns teams before they overrun a budget.
ServiceNow says AI Passport, shadow AI detection and AI Cost Management are expected to be available in Q4 2026. Its Operational Resilience solution for financial services is available now. The release does not say whether the first versions will be previews or generally available.
In the same release, Chandan Pani, CISO of customer LTM, says the company has deployed 1,500 AI agents, each with an employee ID and a manager. ServiceNow also cites its own survey: every bank it surveyed uses AI, but only 24% have governance to match.
Why this matters for Thai businesses
You do not need to run ServiceNow to take something from this. Large enterprise software vendors now treat an AI agent much like an employee. It needs an identity, a defined job, an owner, a way to remove its access, and a budget.
The market is also converging on the idea that knowing an agent exists is not enough. As ServiceNow's Jon Sigler put it, "visibility alone isn't enough." Permissions have to be checked at the moment the agent is about to act.
For Thai organisations this connects to the PDPA. If an agent can reach customer data, you need to be able to explain what permission it used, who granted it, and how quickly you can stop it if something goes wrong.
What to do now
- List the AI agents and AI tools actually in use, including the ones employees signed up for themselves.
- Name an owner for each agent and write down what it may read, change or send.
- Check whether each agent has its own account or is borrowing an employee's access.
- Rehearse revoking one agent without affecting other systems, and time how long it takes.
- Bring all AI spending into one place, covering models, SaaS with built-in AI, and cloud, then set budgets per department.
- Ask your software vendors what permissions the AI in their products runs with, and whether its actions are logged for later review.
If you cannot answer items 1 and 4 yet, start there before adding another agent.
What Enersys does
We have built and supported business software for 14 years, and we work on AI and personal data protection. If your organisation is bringing AI agents into work that touches customer data or back-office systems, and you want permissions, ownership and audit trails clear from the start, talk to the Enersys team.
Sources
