Most organizations control their AI agents with policy. A gateway checks a rule before the agent calls an API; a policy engine decides whether a tool call goes through. That works until the rule needs something the request doesn't carry: who answers for this agent, what it's approved for, how risky we assessed it to be.
What a rule does when a value is missing is also decided engine by engine and rule by rule. Cedar skips a policy that errors. Rego treats an undefined value as undefined. A gateway can be set to fail open when the policy service is down. Each choice makes sense on its own. Together they mean the same agent can be denied at one gateway and allowed at the next.
Today we're publishing AI Passport as an open draft. It hydrates every enforcement point with the same business context, in the same shape.
A signed record of business context
An AI Passport is a signed document about an AI asset, built from the organisation's own records. It says:
- who answers for the asset: its owner and manager;
- where it sits in the organisation;
- who built it;
- how risky it is assessed to be;
- what it is for: its usage area, how autonomous it is, how involved a person is.
It also lists the identities the agent is bound to, and where to check whether it has been revoked. It's plain JSON with a detached signature, so any policy engine reads it as it is.
The same attributes, at every enforcement point
Once the Passport exists, any gateway or policy engine can read the same standard attributes and use them in the policies that matter to you. For a finance agent, that might be:
- an API gateway that requires approval when risk_classification is high or above;
- another cloud's gateway that only allows agents whose usage_area includes finance;
- an MCP server that lets only the finance org unit call the payments tool;
- a policy engine that denies any agent with no manager on record.
Each enforcement point keeps its own policy language and its own rules. What changes is that they all reason over the same facts, and a missing value always reads the same way: as its least favourable value, so it never widens what an agent may do.
One check to stop it everywhere
Business context changes, and sometimes an agent has to stop. Say a finance agent reads a poisoned invoice and starts paying a new payee, through gateways on three platforms. Today, stopping it means finding the right rule in each one while it keeps going.
AI Passport comes with a second specification, Revocation Check v1: one HTTP call that says whether the agent may still act. Revoke the agent once and every gateway that checks denies it on its next check. If a gateway can't get an answer, it denies.
How much work is it for a gateway?
Less than you'd expect. The core check fits on one screen, about 50 lines:
1. fetch the agent's Passport;
2. verify the signature;
3. check it's current;
4. match the identity you authenticated;
5. ask whether it's been revoked;
6. if anything is wrong or unknown, deny.
The example is in the repository. You don't need to read both specifications to get started. Section 1 of each covers the whole happy path in about ten minutes.
The repository also includes a conformance suite with 155 test vectors and a reference implementation. Point it at your gateway, your revocation endpoint or your issuer, and it tells you where you differ from the spec. If you build with a coding agent, AGENTS.md tells it what to read and which rules implementations most often get wrong.
What's next
This first draft covers the Passport format and revocation of an agent as a whole. Next on our list:
- JSON Schemas;
- an OpenAPI description of the revocation check;
- constraints that say what an agent may do;
- scoped revocation, to stop part of an agent rather than all of it.
ServiceNow is also building an issuer for AI Passports. When it becomes available, any gateway that implements the specifications can point at its endpoints with no other integration. Watch the repository for news.
Try it, and tell us what breaks
The specifications are under the Community Specification License 1.0, so anyone can implement them royalty-free. The code and test data are under Apache 2.0.
github.com/ServiceNow/ai-passport
The open questions in each specification are where feedback helps most. Open an issue with what works and what doesn't.
