Why runtime permissions matter for AI agents
An AI agent can do more than produce a response: depending on its integrations, it may read data, call tools, or initiate steps in a business workflow. That makes a simple question central to deployment: what is this agent authorized to access and do right now?
Traditional after-the-fact logs can help teams reconstruct events, but they do not by themselves prevent an action that exceeded an agent's intended scope. Runtime permissions aim to put authorization checks into the execution path, so access and actions can be evaluated as the agent works. They are not a substitute for careful workflow design, identity management, or human review; they are one layer in a broader operating model.
The issue is timely. On October 15, 2026, ServiceNow announced AI Passport, describing it as an authority layer for controlling what AI agents and Model Context Protocol (MCP) servers may do during multi-agent workflows. Its company announcement says the solution uses cryptographically signed credentials that agents check at runtime. CDO Magazine's coverage of the announcement reports that AI Passport was expected to become available in the fourth quarter of 2026. This is a vendor announcement, not evidence that every organization already has the feature; availability and fit should be confirmed directly with the provider.
What ServiceNow says AI Passport is designed to do
According to ServiceNow, each agent receives a credential issued through its Super Intelligence Control Tower and grounded in the enterprise context represented by its Configuration Management Database (CMDB), Governance, Risk, and Compliance (GRC) policies, and workflow approvals. The agent refers to the credential at runtime to verify its authorized scope. For third-party agents, the company says the credential can provide a verifiable permissions record rather than relying on the agent's own claims about its permissions.
The announcement describes graduated responses if an agent moves outside its scope: redirecting it, restricting it, reconnecting it with proper context, or using a kill switch when termination is needed. It also describes audit records behind agent actions. These are capabilities described by ServiceNow; teams evaluating the product should confirm technical details, coverage, configuration requirements, and release status with the company.
ServiceNow also named NVIDIA as a design and launch partner building an enforcement implementation with the NVIDIA Open Agent Safety Platform. The announcement separately said AI Passport, shadow AI detection, and AI Cost Management were expected in Q4 2026. That timing is a forward-looking product expectation and can change.
A practical permission model for business agents
The specific product is only one example of a broader design question. Before an AI agent is allowed to perform work, define the boundaries in terms a business owner and a technical team can both review. A useful starting checklist is:
- Identity: Which agent or service is making the request, and how is it authenticated?
- Purpose: What approved workflow is the agent supporting?
- Resources: Which data sources, tools, and systems are needed for that workflow?
- Actions: Is the agent allowed to read, draft, update, send, approve, or delete? Separate these actions rather than granting broad access by default.
- Limits: What conditions, values, records, or time window constrain the agent's actions?
- Escalation: Which actions require a person to approve, and what should happen when the agent lacks sufficient permission or context?
- Evidence: What record lets an authorized reviewer understand which agent acted, what it was permitted to do, and what happened?
This is practical governance guidance, not a claim that every tool implements each control in the same way. The goal is least privilege: grant the smallest useful set of access and actions, then expand only when a documented business need and appropriate review support it.
Make permissions specific to each step in a workflow
A single business process may involve several agents or tools. For example, one component might extract information from a document, another may check it against a system of record, and a later step may draft a response. Each step can have a different purpose and risk profile. Giving every component the same broad permission set makes it harder to understand which access is truly required.
Map the workflow before deployment. Identify its inputs, outputs, tools, data, and decision points. For each step, specify the minimum permissions and decide whether it can proceed automatically or should pause for human approval. If the process includes outside vendors or delegated agents, document how the organization verifies their identity and authorization rather than assuming that a self-description is sufficient.
Permissions should also account for changing context. A legitimate action in one case may be inappropriate in another because a record is incomplete, a threshold is exceeded, or a required approval is missing. A well-designed workflow should define what the agent does when the preconditions are not met: stop, ask for clarification, route the task to a person, or use another approved path.
Connect the control to reliable business context
Authorization rules are only as useful as the information they rely on. ServiceNow says its AI Passport credentials are grounded in enterprise context from CMDB, GRC policies, and workflow approvals. More generally, an organization should check that the relevant source data, ownership, policies, and approval paths are accurate and maintained.
Before relying on any agent-control system, ask:
- How are agents and their connected tools identified?
- Where do permissions and policy rules come from, and who owns them?
- How are third-party agents handled?
- What happens when an agent's request falls outside the defined scope?
- Can authorized reviewers trace approvals and resulting actions?
- How are permissions updated or revoked when the workflow changes?
A governance platform cannot repair unclear ownership or stale access rules automatically. Assign responsibility for reviewing the underlying context, and establish a process for updating agent permissions when systems, teams, or business processes change.
Test controls before expanding deployment
Start with a narrow, well-understood workflow. Test normal cases as well as situations where the agent should not act: missing information, conflicting instructions, an unavailable system, a request beyond its purpose, or a required approval that has not happened. Confirm that the expected stop or escalation path works and that the event can be reviewed afterward.
For each test, record the intended behavior, the actual result, and any gap. Include both technical and business reviewers: a technical owner can assess integration and access behavior, while a process owner can judge whether the boundary reflects the real workflow. Revisit the test plan after changes to tools, policies, or the agent's responsibilities.
Avoid treating a successful demonstration as proof of production readiness. Production use also depends on operational ownership, monitoring, incident handling, appropriate human review, and the organization's own legal and compliance requirements. The exact controls vary by industry and use case.
Measure governance as part of the business case
Runtime permissions can help an organization define and enforce boundaries, but a control layer does not by itself prove that an agent is useful or safe for every task. Decide how the team will evaluate both workflow performance and governance: for example, whether tasks are completed correctly, exceptions are routed appropriately, access is limited to approved resources, and reviewers can investigate actions when needed.
ServiceNow's announcement also described expanded discovery and cost-to-value measurement capabilities in its Super Intelligence Control Tower. These product claims should be assessed against an organization's own requirements and verified with the provider. Regardless of platform, connect measurements to a specific workflow and baseline rather than making broad claims about automation value from a single metric.
The practical takeaway is to treat AI agent runtime permissions as a design and operations issue, not a checkbox. Define the scope, enforce it where actions happen, retain useful evidence, test out-of-scope behavior, and assign people to maintain the rules. This makes it easier to scale useful automation without giving agents more authority than their tasks require.
FAQ: AI agent runtime permissions
What are AI agent runtime permissions?
They are authorization rules checked while an AI agent is running, defining which resources or actions it may use in a particular workflow.
What is ServiceNow AI Passport?
ServiceNow describes AI Passport as a credential-based authority layer that verifies an agent's authorized scope at runtime. The company said it was expected in Q4 2026; confirm current availability with ServiceNow.
Are audit logs enough to govern AI agents?
Logs can help explain actions after they happen. Runtime checks address a different need by evaluating whether an action is authorized as it is attempted. Organizations may need both, alongside other governance measures.
Zapplon offers AI agents, AI videos, and performance marketing services to help businesses plan and build automation that fits their goals. Contact Zapplon to discuss a project. Services start at $50.