ServiceNow and Nvidia have made Arc generally available, turning a May announcement into a shipping product for enterprises that want a long-running AI agent but are not willing to sacrifice control over data, permissions, or execution. Arc is described as a personal AI agent that can take on everyday work, and its launch is as much about security architecture as it is about productivity features. The companies are positioning the agent for daily tasks that depend on email, Microsoft Teams, meeting notes, and other productivity tools, while surrounding it with multiple layers of policy enforcement and runtime restrictions.

Key facts

• Arc is generally available after a May announcement.
• The agent is built for Nvidia RTX Spark devices and can run locally or within Nvidia OpenShell.
• It is designed for everyday work with email, Microsoft Teams, and meeting notes, building memory and skills over time.
• Security layers include ServiceNow Super Intelligence Control Tower, Nvidia OpenShell, AI Passport, and Nvidia BlueField enforcement.
• Arc is available on Mac now, with Windows support planned.

The timing reflects a broader tension in enterprise AI. Companies are eager to deploy agents that can act across applications, summarize information, surface action items, and complete routine workflows, but many IT and security teams remain cautious. A major roadblock is adequate security controls, especially after a period of agent-led breaches that exposed how quickly autonomous systems can run into trouble when permissions are too broad or oversight is too thin. Arc attempts to answer that concern by combining AI capabilities with security-first guardrails rather than treating security as an add-on.

What Arc is designed to do

Arc is built for everyday enterprise work. Like many agents now aimed at business use, it is designed to work with productivity tools such as email and Microsoft Teams. It can scan an employee's inbox and meeting notes to proactively surface work and action items, reducing the manual effort required to track commitments, follow-ups, and pending tasks. The agent is intended to build memory and skills over time, so its performance improves as it accumulates context about the employee's work patterns and priorities.

The product is designed to run efficiently on Nvidia's new RTX Spark devices. It can operate locally on an employee's desktop or within Nvidia OpenShell on its own device. That local-first design matters for enterprises that want to keep sensitive data close to the user and avoid sending every request to a cloud model. The companies say Arc is efficient, handing more complex tasks off to frontier models only when necessary and keeping data as local as possible otherwise. This hybrid approach may appeal to organizations that want the benefits of advanced AI without accepting unnecessary data exposure.

Arc is also a long-running agent, meaning it is meant to persist and accumulate context rather than function as a single-session chatbot. That persistence is central to its value proposition: an agent that remembers prior work, understands recurring workflows, and can act on accumulated knowledge is more useful than one that starts from scratch each time. But persistence also raises the stakes for security. The longer an agent runs and the more context it gathers, the more important it becomes to define what it can access, which APIs it can call, what data it can read, and what happens when it attempts something outside its approved scope.

Why security is central to the launch

ServiceNow and Nvidia are emphasizing that Arc's security model moves enforcement beyond the software layer into the runtime and hardware layers. In practice, that means the agent is not simply trusted to follow written rules. Instead, policies are enforced while the agent is operating. ServiceNow's Super Intelligence Control Tower is used to define and enforce company policies, while Nvidia OpenShell restricts the agent's behavior where necessary. IT teams can set policies in the Control Tower, and OpenShell can be directed to enforce them at runtime.

The companies say this gives users granular control over which systems AI agents can access, which APIs they can call, and which data they can read. That level of control is important for enterprise adoption because agents often need to touch multiple systems to be useful. An agent that can read email, inspect meeting notes, and interact with collaboration tools may also need access to calendars, documents, or internal applications. Each additional permission expands the attack surface. Runtime enforcement aims to keep the agent within boundaries even if its model behavior changes or if it encounters unexpected instructions.

The security design also reflects a lesson from recent agent deployments: permission sprawl is a practical risk. An agent may be granted broad access to make it more capable, but broad access can turn a minor error into a serious incident. By enforcing policy at runtime, the architecture is intended to prevent an agent from moving beyond its assigned role. This is especially relevant for agents that act autonomously over long periods, because the chance of an edge case or unexpected interaction increases with time and scope.

AI Passport and layered enforcement

A second layer of security comes from AI Passport, which the two companies announced before Arc's general availability. AI Passport holds an enterprise's set of rules, established through the Control Tower, about risk tolerance and the services that Arc and other agents are allowed to access. It functions as a bridge between ServiceNow's infrastructure and Nvidia's checkpoints, allowing Nvidia features such as OpenShell to intervene efficiently if an AI agent takes an action it is not supposed to take.

The system is designed to continuously monitor an agent's actions and permissions to prevent breaches, unsanctioned actions, and other fallout from agent use. If the Control Tower indicates that an agent's passport has been revoked, OpenShell will keep the task the agent was trying to execute contained within a sandbox, where reviewers can audit it later. The interruption is task-specific, meaning other approved agent actions can continue without requiring a restart. That detail matters for productivity: security controls that halt everything at the first sign of trouble may be safe but impractical, while controls that isolate the questionable task can preserve legitimate work.

The companies also say Nvidia BlueField can enforce a passport revocation at machine speed before the AI agent can proceed. This creates enforcement in silicon designed to prevent overrides from compromised software. In other words, the security model does not rely solely on the agent's software stack or on the model's willingness to comply. It pushes critical decisions down to infrastructure that is harder to bypass. For enterprises, that is a meaningful claim because agent security is often only as strong as the weakest layer between the model and the systems it can affect.

Local AI, hardware, and enterprise governance

Arc's reliance on Nvidia RTX Spark devices places it within a growing push toward local and hybrid AI. Running an agent locally can reduce latency, keep sensitive context on the device, and give IT teams more direct control over the environment. At the same time, local execution has limits. Complex tasks may still require frontier models, which is why the companies describe a tiered approach: handle what can be handled locally, and escalate only when necessary. That approach can balance capability, cost, and data exposure.

For enterprise governance, the combination of Control Tower, OpenShell, AI Passport, and BlueField represents an attempt to operationalize agent policy. Instead of relying on users to avoid risky prompts or on developers to anticipate every failure mode, the system tries to enforce boundaries through infrastructure. IT can define which systems an agent may access, which APIs it may call, and which data it may read. Security teams can monitor actions and permissions continuously. If something goes wrong, the response can be scoped to a specific task and audited later.

That model may become a template for how enterprises adopt agents more broadly. The value of an agent comes from its ability to act, not just chat. But action requires trust, and trust requires controls that are visible, testable, and enforceable. Arc's launch is therefore a test case for whether enterprises will accept long-running agents when those agents are wrapped in policy enforcement, runtime restrictions, and hardware-level safeguards. The product's success will depend not only on how well it performs everyday tasks but also on whether IT teams believe the guardrails hold under real-world pressure.

Arc is available now on Mac, with Windows support still on the way. That phased platform rollout means the initial audience will be Mac-based employees and teams, while Windows users will have to wait for broader deployment. For organizations evaluating Arc, the immediate questions will likely focus on integration with existing productivity tools, the granularity of policy controls, the audit trail for sandboxed tasks, and how the local versus frontier-model routing affects data handling. Those operational details will determine whether Arc becomes a standard enterprise agent or a narrowly adopted tool.

Source:ZDNET News