ServiceNow Names Agent Governance a Product Line — Stock Pops 6% as Decagon Denial Caps M&A Fever

ServiceNow announced AI Passport and a major expansion of the Super Intelligence Control Tower on Oct 15, 2026, billing both as billable line items rather than free features of the platform. AI Passport is a cryptographically signed credential assigned to each AI agent and Model Context Protocol (MCP) server, verified at every step of a workflow against business context held in the CMDB, governance policies and workflow approvals. In a pre-launch demo, a refunds agent with an authorization ceiling of 25 auto-approved an 18-value request and was blocked from automatically handling a 40-value one — graduated enforcement that ServiceNow says distinguishes governance from a blunt kill switch. The renaming of the existing AI Control Tower to \"Super Intelligence\" signals an ambition that goes well beyond ITSM.

The same release adds shadow AI detection (to surface unapproved agents on the network), 400+ out-of-box connectors for AI discovery, AI Cost Management embedded in IT Asset Management, and Operational Resilience for financial services, which is available immediately. AI Passport, shadow AI detection and AI Cost Management are slated for Q4 2026 availability, in time for the Yokohama platform release. The composite is the first time a major enterprise software vendor has packaged runtime authorization, discovery, cost and audit as a single control plane — and shipped it under a marketing name investors can track on the call sheet.

NVIDIA's role is concrete, not decorative. AI Passport wires ServiceNow's business-context authority into NVIDIA's Open Agent Safety Platform — open-source OpenShell runtime plus the Sentry hardware-level monitor designed to run on BlueField DPUs — so that when an agent drifts, the enforcement happens at the silicon/runtime boundary, not just at the application log. The architecture also gives NVIDIA a second enterprise anchor for OpenShell, beyond its own Blackwell systems, in a category where the chip vendor competes with Microsoft, Okta and Palo Alto Networks for the same control-plane mindshare.

For NVIDIA, AI Passport is a software-attach story for BlueField: every ServiceNow customer that enables machine-speed kill switch effectively needs the Sentry DPUs to make the enforcement deterministic. ServiceNow has already crossed $1B in AI ACV in Q2 FY2026 and is targeting $1.5B by year-end — agent governance becomes a BlueField attach surface by default.

AI Passport is the new front door, but the building was already standing. ServiceNow closed the $2.85B acquisition of Moveworks in December 2025, folding in front-end AI assistants and enterprise search; it followed with the roughly $1B acquisition of Veza in late 2025, an AI-native identity security platform that already handled non-human identity (NHI) authorization. Veza is the substrate Passport inherits for access-mapping; Moveworks is the front-end agent fleet. Together, AI Passport plus Super Intelligence Control Tower constitute the first end-to-end governance stack in the enterprise software market — discovery, identity, runtime enforcement, cost and audit on a single data model.

ServiceNow also shipped AI Workflow Factory on Oct 6, 2026 in Mumbai, linking Process Mining, Build Agent, App Engine and AI Control Tower into a continuous agentic loop. The point of AI Passport isn't a new product; it's the credential layer that finally lets customers turn on the workflow factory without an audit gap. That is the value prop investors can price.

Two days before the AI Passport launch, on Oct 13, 2026, ServiceNow issued a public statement — attributed to Amit Zavery, president, CPO and COO — that it had \"no interest or intention of purchasing Decagon\" and reaffirmed that \"we remain an organic growth company first.\" Decagon, an AI customer-service agent startup valued at $4.5B after a $250M Series D in January 2026, had been the subject of acquisition speculation. ServiceNow's denial arrived in the same week as a string of multibillion-dollar M&A items — the $2.85B Moveworks and ~$1B Veza deals still inside the integration window — and at least one analyst noted investors were growing wary of further large-scale take-ons.

The pairing — AI Passport productizing a category, Decagon denial capping M&A — sent a single message: ServiceNow intends to win agent governance organically, on its own stack, not by buying the next agent company. Given that ServiceNow closed Q2 FY2026 with subscription revenue of $3.877B (+24.5% YoY), 658 customers above $5M ACV (+23% YoY) and free cash flow margin above 60%, the organic-growth story has the run-rate to defend the thesis.

Agent governance is becoming a single named budget line — and the field is unusually crowded. Microsoft already integrates ServiceNow's Control Tower with Agent 365 and Purview (general availability in 2026), which makes Microsoft a partner and a competitor at the same line item. Salesforce is leaning into \"agent sprawl\" messaging and Agentforce Operations; Okta is shipping Agent SSO and fine-grained authorization for shared-workspace agents; Palo Alto Networks is folding CyberArk into an agent-identity stack and has called out the same market; Cisco bought Astrix Security for NHI; CrowdStrike extends Falcon to agent endpoints. Every one of them is now chasing the line item ServiceNow just put on a product page.

What differentiates ServiceNow today is the combination of a CMDB-grounded authorization model (Passport), an already-acquired identity layer (Veza) and the existing enterprise footprint. Okta has identity but no workflow; Microsoft has workflow via Foundry and Copilot Studio but ships governance from the inside of its own estate; Salesforce is anchored to CRM data; Palo Alto Networks and CrowdStrike are security-first. None of them ship a credential layer for MCP servers in CMDB context on day one. That gap is what AI Passport fills — at least until one of them catches up.

On the multiples side, the TTM snapshot ServiceNow prints EV/Sales around 10.8x and EV/FCF around 34.8x — rich on absolute terms, but compressed from the 19.9x EV/Sales it printed at FY2024 close. The +6.14% pop on Oct 15 puts the stock at ~$148.57, still ~29% below the FY2024 multiple peak even after the Q1 relief rally that followed the worst sell-off. Citi raised its target to $170 from $154 on Oct 14, citing channel checks showing improving AI interest; the consensus average now sits near $151, with the high at $236.

Long term, the question is whether agent governance becomes a separate line item — or remains an extension of the platform. ServiceNow is betting on the first outcome: a named, marketable category that justifies dedicated sales motions, premium SKUs and a place on the CIO's budget form. If AI Passport, the Super Intelligence Control Tower and AI Cost Management collectively convert to even5% of new AI ACV at the 2030 target of $30B subscription revenue, that is roughly $1.5B of incremental annual contract value attributable to governance — a non-trivial buffer against the AI attach-rate math that drives the multiple.

The risk is that the partner stack copies it before the line item is consolidated. Microsoft's Agent 365/Purview integration already spans ServiceNow agents; Okta's Agent SSO and Palo Alto Networks's NHI play are real; Salesforce is pushing Agentforce as the agent default. By the time AI Passport ships in Q4 2026, three of those competitors will have had 6–12 months to position their own governance story. The credential layer — cryptographic, MCP-aware, CMDB-grounded — is the moat, and NVIDIA's runtime anchor makes it sticky. That moat only holds if the integrations stay intact and ServiceNow actually ships Passport in Q4 2026 without slipping.