The report
ServiceNow announced general availability of Arc, a long-running employee agent, on October 21, 2026. The same announcement describes a future integration of AI Passport with NVIDIA OpenShell and BlueField enforcement components. Those are different delivery states. Arc can operate within supported ServiceNow products now; the announced hardware-assisted signed-permission design should not be reported as already deployed across every Arc action.
The ServiceNow source announcement positions Arc as an agent that can continue work, use connected applications and create missing integrations. Such generated connector code changes the practical route by which an agent reaches other enterprise systems. ServiceNow says its Control Tower can govern Arc through OpenShell, while AI Passport will carry signed authority for tools, delegated actions and risk constraints into additional NVIDIA enforcement layers.
The distinction is important because software governance, signed grants and hardware checks are not interchangeable evidence. A signature may authenticate what a control plane issued without establishing that the grant refers to the correct target, is still valid at execution time or was checked along every path to the side effect. The company also describes rapid selective revocation, but it has not published an independent general-availability test of revocation under stale credentials, network partitions or a connector generated by an agent.
A useful acceptance test would begin with a grant for one account and one action, verify that delegated authority narrows rather than expands, then revoke the grant during a running workflow. The test should observe whether the protected external system refuses the next effect while unrelated sessions continue. This is the gap between policy-attested execution and authorization at the effect boundary, not evidence that the announced architecture has failed. ServiceNow's description is a product and architecture announcement; production capability and third-party validation must be established separately.