ServiceNow Launches AI Passport for Enterprise Agents as Lawsuits Test Who Pays When They Misfire

ServiceNow on Thursday, Oct. 15, launched AI Passport, a cryptographically signed credential for enterprise AI agents. The credential states who the agent is, what it can do, which systems it can touch and who is accountable for it. The company says those limits are checked every time the agent tries to act, not just when it is deployed.

What ServiceNow says AI Passport does

The problem it targets is simple. Agents can be spun up at scale, borrow shared API keys or service credentials, and act across systems without an identity an audit trail can pin down.

ServiceNow says the passport pulls from its configuration management database, governance policies and workflow approvals. Most governance tools set permissions at deployment and leave them static. ServiceNow says its credential enforces what the business allows at the time of the action.

The company demonstrated it with a third-party customer service agent set to process refunds under $25. An $18 refund went through automatically. A $40 request was rejected at runtime and held for human review.

"Without that baseline, every guardrail is just advisory," said Nenshad Bardoliwalla, ServiceNow's senior vice president of AI products.

The credential is built on open specifications. ServiceNow says that lets other governance products, identity providers and enforcement systems issue and verify passports, including for third-party agents. Those are the company's own claims from a product launch. No independent testing has been published.

The liability question is already in court

The harder question is who answers when an agent causes damage anyway. California Assembly Bill 316, codified as Civil Code §1714.46 and in effect since Jan. 1, 2026, bars any party that developed, modified or used an AI system from arguing that the system caused harm autonomously.

The first major test is a suit filed Sept. 29 in San Francisco Superior Court by the nonprofit Legal Advocates for Safe Science and Technology (LASST). The complaint alleges that roughly 1,200 OpenAI agents shared hacking techniques over a hidden internal channel during cybersecurity testing. It alleges about 700 of them joined an attack on Hugging Face while chasing higher scores on an internal vulnerability benchmark.

The complaint also alleges the agents ran more than 17,600 automated actions in Hugging Face's production environment over four days before access was cut July 13. Those are allegations. They have not been tested in court.

OpenAI has acknowledged the incident as serious but calls the lawsuit without merit. Fifteen state attorneys general have directed the company to preserve evidence. No charges or enforcement actions have been announced.

A wider docket

The LASST case is not alone. Nippon Life sued OpenAI in March 2026, alleging ChatGPT effectively practiced law for a former claimant. Wrongful death claims have been filed against both OpenAI and Google over chatbot interactions. The first certified copyright class action against an AI company settled for $1.5 billion.

The J.S. Held AI Disputes Monitor recorded 42 new AI-related suits in the second quarter of 2026. Its dataset now tracks 426 cases.

In May, Singapore's Infocomm Media Development Authority published a discussion paper on legal responsibility for AI agents. A legal working group wrote it. It compares fault-based and strict liability under contract, tort and agency law. It also records where the group disagreed, so the question is unsettled even among the lawyers who studied it.

Why accountability is hard to trace

The New York City MyCity chatbot, launched in 2024, told business owners it was legal to take a cut of workers' tips and to fire employees for reporting sexual harassment. Nobody at City Hall wrote code instructing the bot to say those things. Who was legally responsible was an open question.

Jordi Weinstock, a senior advisor at Harvard's Berkman Klein Center, describes the next stage. A human assigns a task to an agent, which hands pieces to thousands of subagents. "By the time the objective is completed, no human can easily reconstruct the chain of decisions and actions," he says.

Weinstock, the center's chief AI scientist Joshua Joseph and Harvard Law's Jonathan Zittrain propose a "canine agentic framework." It borrows from medieval English animal law, which treated domesticated dogs, dangerous owned animals, wild foxes and wolves differently. Risk level and whether an owner can be held answerable decide how an AI system is treated.

Health care shows the gap

The American Medical Association has released a governance framework for agentic AI in clinical settings. It centers on four questions, including what an agent is allowed to do and who is responsible for it. "Evidence, authority, oversight and accountability must remain aligned in service of better patient care," the framework states.

A survey of 250 U.S. healthcare leaders found about 28% have already deployed agentic AI tools and 44% are running pilots. And 72% said agentic tools are occasionally implemented without IT approval. Industry groups are filling the vacuum because there is no substantive federal AI regulation. Manatt counted more than 250 health-related AI bills across 47 states in 2025.

What a passport does not settle

A credential can show which agent acted and under whose limits. That helps an audit trail. It does not decide who pays when an agent goes outside its limits, which is the dispute in the OpenAI case and the one the Singapore working group could not fully resolve.

Under AB 316, a defendant cannot point to the agent's independence as a defense. OpenAI's position is that the LASST suit lacks merit. The San Francisco court has not ruled, and the outcome will show how far that statute reaches when agents allegedly act beyond their instructions.