The News
ServiceNow has announced the general availability of Arc, a personal long-running AI agent designed for enterprise employees, alongside a deepened governance partnership with NVIDIA. Arc is included at no additional cost across ServiceNow’s Foundation, Advanced, and Prime SKUs and runs within a secure NVIDIA OpenShell runtime, allowing it to autonomously manage tasks across workflows, email, and productivity tools while remaining subject to enterprise policy controls. Complementing Arc’s launch, ServiceNow’s AI Passport solution will integrate with NVIDIA OpenShell and the BlueField data processing unit to carry and enforce per-agent permissions across both software and silicon layers, with sub-second revocation propagation and precision containment that stops a compromised agent without disrupting other workloads.
Analyst Take
The governance problem is the real product
Enterprise AI agents are no longer a roadmap item. They’re executing real tasks, calling real APIs, and writing to real systems of record. The central anxiety for IT leaders isn’t whether agents can do the work; it’s whether the enterprise retains meaningful control when they do. ServiceNow and NVIDIA are positioning themselves as the answer to that anxiety, and the architecture they’re describing is more serious than typical vendor governance theater.
The AI Passport concept is the most architecturally interesting piece of this announcement. Rather than relying solely on software-layer access controls, which can be bypassed by a sufficiently compromised agent process, the ServiceNow and NVIDIA approach pushes enforcement into NVIDIA BlueField DPUs. That means revocation decisions made in the Super Intelligence Control Tower propagate to hardware before a misbehaving agent can act. For security architects, this is meaningful: it closes a gap that purely application-layer governance frameworks leave open. The claim of sub-second propagation across both layers, with a revoked agent’s traffic isolated while other workloads on the same host continue, is the kind of operational precision that security teams will want to validate in proof-of-concept environments before trusting it at scale.
What this means for ITDMs: control at scale, not just on paper
For IT decision-makers, the governance question is inseparable from the deployment question. Organizations want to give AI agents real authority because that’s where the productivity gains live, but authority without enforcement creates liability. The AI Passport model, where each agent carries an attested record of what it’s allowed to do, is a credible answer to the board-level question of who is accountable when an autonomous agent makes a costly mistake. The fact that Arc ships as part of existing EmployeeWorks SKUs at no additional cost is also a deliberate land-and-expand play: ServiceNow gets Arc into the hands of enterprise employees without requiring a new procurement cycle, lowering the activation energy for adoption considerably.
The compliance dimension matters here too. According to ECI Research’s Google GovTech Survey, 31.8% of respondents cited FedRAMP and compliance approval friction for AI vendors as the single largest blocker preventing widespread AI adoption in developer workflows. That finding reflects a broader pattern: organizations want AI tooling but are held back by authorization processes that weren’t designed for fast-moving software. An AI governance architecture that bakes compliance evidence and policy enforcement into the agent itself, rather than treating it as an afterthought, directly addresses that friction. The AI Passport model, if it delivers on its promise, could become a template for how other platform vendors approach FedRAMP-adjacent AI governance.
The developer angle: Arc as an integration builder
Developers should pay close attention to one specific Arc capability: the ability to build integrations on the fly when a pre-built connector doesn’t exist. This is a qualitatively different claim from standard iPaaS or workflow automation. If Arc can reliably identify an integration gap and generate a functional, policy-compliant connector, it compresses what has historically been a multi-sprint engineering effort into an agent-driven task. The constraint that Arc runs anything it builds inside the same NVIDIA OpenShell boundary is the right engineering instinct — it means dynamically generated code can’t reach outside its authorized scope, which is the attack surface concern that would otherwise make this capability untenable in a regulated environment.
On AI adoption broadly, the survey data presents a nuanced picture. According to ECI Research’s Google GovTech Survey, 49.6% of respondents estimated that 26% to 50% of their organization’s code will be assisted or generated by AI within the next 12 months. That’s a substantial majority of code touching AI tooling, which means the governance infrastructure for AI-generated work is no longer a future problem. It’s a current one. Arc and AI Passport are ServiceNow’s answer to that problem for the workflow and enterprise application layer, and they’re betting that the platform that governs the work will also govern the agents doing it.
Looking Ahead
ServiceNow’s strategic logic here is clear and defensible. The company already sits at the center of enterprise workflow orchestration for a significant portion of the Global 2000. Adding a personal AI agent layer, governed by infrastructure that extends from the ServiceNow control plane all the way to NVIDIA silicon, is a bid to own the governance stack as AI agents proliferate across enterprise environments. The NVIDIA partnership is not window dressing: BlueField DPUs are increasingly deployed in AI factory configurations, and having enforcement baked into that substrate rather than bolted on top is a durable architectural advantage that pure-software competitors can’t easily replicate.
The near-term watch item is AI Passport’s actual release timeline and the depth of NVIDIA BlueField integration when it ships. The press release appropriately flags this as a future release, and the distance between a compelling architecture diagram and a production-grade, FedRAMP-ready governance system can be significant. ServiceNow’s advantage against competitors is its existing enterprise footprint and the credibility of a hardware-layer enforcement partner. If AI Passport ships with the compliance evidence and auditability that regulated enterprises require, ServiceNow will have established a governance standard that others will spend the next two years trying to match.
Stay Ahead of Application Development Trends
Get weekly analyst insights, research notes, event coverage, and AppDevANGLE updates delivered directly to your inbox.
Subscribe for Weekly Insights
Join technology leaders, practitioners, and GTM teams following the trends shaping modern software delivery.
Looking for deeper research access?
Explore ECI Research reports, survey insights, and market analysis through the ECI Research Portal.
