ServiceNow Arc Is Generally Available: A Personal Enterprise Agent Governed by AI Passport and Enforced by NVIDIA OpenShell

ServiceNow has put an AI agent in every employee's pocket and tied its leash to NVIDIA hardware. On October 21, 2026, at GTC Berlin, ServiceNow announced that Arc, a personal, long-running enterprise AI agent, is generally available, governed by its Super Intelligence Control Tower and enforced by NVIDIA OpenShell. The bigger idea in the release, an "AI Passport" that lets NVIDIA's software and silicon honor ServiceNow's policies and revoke an agent within about a second, is explicitly still to come. This post separates the two.

TL;DR: what is live and what is planned

What does Arc do?

ServiceNow describes Arc as a personal agent that takes on everyday tasks across its workflows, email, Teams and other common tools. The release lists five capabilities:

• Autonomous task ownership. You assign a goal rather than a list of steps; Arc plans, executes across enterprise systems, checks its own work and adjusts, for "minutes or days."
• Proactive work identification. It surfaces action items from a backlog, inbox, meetings and conversations: assigned tasks, pending approvals, follow-ups.
• Integrations on the fly. When an integration does not exist, Arc can build one, and it is designed to run anything it builds inside the same OpenShell boundary.
• Memory and skills. It builds memory and develops skills over time.
• Local-first inference. Arc is designed to use local models on NVIDIA RTX Spark for routine work and call frontier models for harder tasks, which ServiceNow says lowers cost and keeps more data on the device.

Arc can run on its own computer inside a secure OpenShell runtime or on an employee's desktop. That choice matters for risk: an agent on its own machine can be contained and monitored more tightly than one with the run of a laptop. For background on the runtime, see our explainer on NVIDIA OpenShell and Sentry.

A badge on a lanyard with a green ring, illustrating the identity credential that bounds what ServiceNow Arc can access

How does governance work?

The model is "govern once, enforce everywhere." IT defines policies in the Super Intelligence Control Tower, ServiceNow's governance console, and NVIDIA OpenShell is directed to enforce them at runtime, giving granular control over which systems an agent can access, which APIs it can call and which data it can read. The release says IT can restrict a single action, such as writing to a production system, while the agent continues the rest of its work.

AI Passport extends that to other layers. ServiceNow defines it as an attested record that the Control Tower is designed to issue to each AI agent, MCP server and other governed asset, carrying business context such as decision logic and vendor risk, risk tolerance, and which external services an agent may use. Enforcement points can then check it "at the moment of orchestration and operation." Three layers are described:

1. Action-level control in the Control Tower, for first-party and third-party agents alike.
2. Software-layer enforcement in OpenShell, which reads the policies and is designed to honor revocations, stopping an agent in its sandbox and keeping activity contained and auditable.
3. Hardware-layer enforcement with NVIDIA Sentry on BlueField, which reads agent status through the passport with hardware-backed trust and can, ServiceNow says, enforce a revocation at machine speed before the agent proceeds. That is the "in silicon" claim: a design meant to prevent overrides from compromised software.

The release adds two properties: revocation propagation "within approximately one second" across both layers, and precision containment, meaning a revoked agent's traffic stops while other workloads on the same host continue and restoration needs no restarts. NVIDIA's own OpenShell Reference Architecture release says the reference architecture lets enterprises "revoke an AI agent's access across software and hardware within seconds," and says it is available now, while ServiceNow's AI Passport enforcement is not.

Why the "future release" caveat matters

Read the availability paragraph carefully. Arc is generally available, and it is governed by the Control Tower and enforced with OpenShell today. But "AI Passport, including enforcement in NVIDIA OpenShell and NVIDIA BlueField DPUs, is expected to be available in a future release." The sub-second revocation, hardware enforcement and precision containment all depend on that integration. Buyers should therefore treat the one-second figure as a design target: no test conditions, number of agents, network assumptions or measurement method were published, and nothing independent confirms it.

Also note the vendor framing. "Industry-first" in ServiceNow's headline is a marketing claim, and the performance and security statements come from the two companies. The release carries standard forward-looking-statement language warning that product capabilities may be delayed or change.

How does this fit NVIDIA's reference architecture?

NVIDIA's press release says Anthropic, AWS, Cisco, CrowdStrike, Dassault Systèmes, Dell Technologies, Google Cloud, HPE, IBM, Meta, Microsoft, OpenAI, Palo Alto Networks, Perplexity, SAP, ServiceNow, Siemens and others are working with the OpenShell Reference Architecture, and that enterprises can run agents from model builders including Anthropic, Cohere, Google, Meta, OpenAI, Perplexity, Reflection and SpaceX Super Intelligence on OpenShell infrastructure. Cybersecurity vendors 1Password, Check Point, CrowdStrike, Cisco, F5, Fortinet, Microsoft, Okta, Palo Alto Networks, TrendAI and Zscaler say they are integrating support. Such lists show breadth of intent, not depth of deployment, and "working with" can mean anything from a pilot to a press-release partnership. For the keynote context, see our GTC Berlin recap, and for the hardware side, Sentry, DOCA Tower and Argus on BlueField-4.

Identity for agents is becoming its own product category. Workday's purchase of ConductorOne, which we covered in Workday acquires C1 for agent identity governance, points the same way: companies want a registry of what an agent is and what it may do, with the power to switch it off.

How is a personal agent different from a chatbot or a workflow bot?

A chatbot answers when asked. A workflow bot follows a fixed script. A personal long-running agent holds a goal over hours or days, decides its own steps, uses the same tools an employee does, and keeps memory between sessions. That combination is what makes it useful and what makes governance hard. Each step the agent takes can use real credentials, and each skill it picks up is a new behavior that nobody wrote down in advance.

Three risks follow, and they explain why ServiceNow built its pitch around control. First, scope creep: an agent that proactively surfaces work from an inbox and meetings can also read far more than the task needs, so access has to be limited by action and by data, not by application. Second, self-built integrations: letting an agent write its own connector is powerful, and a connector that runs outside any boundary would be a way around every policy, which is why the release says Arc runs what it builds inside the same OpenShell boundary. Third, memory: what an agent remembers about an employee, a customer or a deal is itself sensitive data, and the release says little about retention or deletion. Those are the questions to settle in a pilot before wide rollout, and they apply to any vendor's personal agent, not just this one.

What should security and IT teams ask?

• What exactly is enforced today? Ask for a demo of Arc under OpenShell policy without AI Passport, and a roadmap date for the passport features.
• Where does Arc run? On a dedicated machine in OpenShell, or on user desktops? The risk profiles differ.
• What data leaves the device? Local models on RTX Spark are meant to keep more data local, but frontier-model calls still send data out. Ask which tasks route where and who decides.
• How are third-party agents and MCP servers handled? The passport is described as covering them; ask how they obtain one.
• What is the failure mode? If the Control Tower is unreachable, does Arc stop, continue with cached policy, or run unrestricted?
• Can revocation be tested? A one-second claim should be reproducible in a proof of concept, with logs.
• What are the audit trails? OpenShell is described as keeping activity contained and auditable; ask what is recorded and for how long.

For teams running coding agents outside this stack, a separate policy layer can block dangerous agent actions before they run; AgentBeam, from the explainx.ai team, is one such option.

Why it matters

Personal agents are moving from demos to products with a price tag of zero for existing customers, which will put them on many employees' machines quickly. The open question is whether governance arrives with them. Arc's design, an isolated runtime with central policy, is a reasonable pattern; the version that includes cryptographic passports and hardware enforcement is not yet shipped. Until it is, the sensible reading is a promising architecture with part of its safety story still on the roadmap.

Related reading

• NVIDIA OpenShell and Sentry: the open agent safety platform
• Sentry, DOCA Tower and Argus on BlueField-4
• GTC Berlin 2026 keynote recap
• Workday acquires C1 for agent identity governance
• NVIDIA RTX Spark: code, test and deploy on one machine
• NVIDIA Confidential Bare Metal and European AI clouds

Details reflect ServiceNow's and NVIDIA's October 21, 2026 releases; availability and features may change.