When AI can act, permission becomes architecture

An AI assistant drafts a reply to a customer asking for a refund. Someone reads it, adjusts it, and sends it. An AI agent does something different. It verifies the account, checks the policy, issues the credit, updates the record, and sends the customer a confirmation while the team is in a meeting. The first system produced information. The second changed the business.

That second step is where the measurable value is, and even heavily regulated organizations are now heading there. Bank of Singapore is rolling out an agentic platform that gathers due diligence and credit risk information for wealth client onboarding, expected to cut account opening from more than thirty business days to about fifteen. The model is the least interesting part of that story. The significant step is that AI is being placed inside a regulated operational process, where its actions, evidence, and handoffs have to fit the bank’s existing accountability structure.

The moment AI moves from recommending to executing, the deciding question changes. It is no longer whether the model can do the task. It is under whose authority it acts, what it is allowed to change, and what happens when the situation falls outside its instructions.

Not every action deserves the same permission

Reading a record, recommending a step, preparing a draft, executing a change, approving someone else’s change, and reversing one are six different acts. A wrong recommendation costs minutes. A wrong execution is an incident, with a customer, a ledger entry, or a compliance obligation attached. Treating those acts as one capability with one level of access is how pilots become liabilities. The irreversible category was small in Anthropic’s sample. Of roughly one million tool calls observed on its public API, only 0.8 percent appeared irreversible. Design so the routine work stays reversible, and the few actions that are not can afford a heavier gate.

Every executed action also crosses a boundary that used to have a person standing on it. A refund crosses a financial threshold. A record update crosses a data ownership line. A message to a customer crosses the edge of the brand. None of those boundaries disappear because the actor is software. They just stop being enforced by habit and have to be enforced by design.

The agent needs an identity of its own

The fastest way to ship an agent is to hand it a shared service account or a login borrowed from an administrator. It is also the decision most likely to be regretted. An agent without its own identity cannot be given least privilege, cannot be audited apart from the people around it, and cannot be revoked without breaking something else.

The scale of the problem is already uncomfortable. Palo Alto Networks’ identity research counts 109 machine identities for every human identity, up from 82 a year earlier. Yet only 37 percent of the organizations it surveyed say they can revoke an AI agent’s credentials, and only 30 percent keep immutable audit logs of what their agents do. Agents are arriving into that gap, and they act faster than anything the gap was built for.

A production agent deserves what any new operator of business systems gets: a dedicated identity, access scoped to the one workflow it runs, credentials that expire and rotate, and a named owner who can answer for it. OpenAI’s Presence platform, announced in July, illustrates the same design pattern. It gives an agent only the knowledge and system access its job requires, and has the customer write the rules for what it may do, when it needs sign-off, and when a person takes over. The pitch is designed authority, not raw capability.

Useful autonomy is bounded autonomy

An agent worth putting into production has a defined job, a list of systems it may touch, actions it may take, actions it may never take, and thresholds where a person enters. In the refund workflow that looks concrete: the agent may verify, decide, and execute up to a set amount, must request approval above it, and must stop entirely when information is missing, records conflict, or the customer disputes the outcome. The stopping point is designed, with a handoff and an owner, so an exception becomes a ticket rather than an improvisation.

An agent that improvises past its boundaries is making unowned decisions in your name.

Gartner has put a second number on agent failure, separate from its earlier cost warning. It expects four in ten enterprises to demote or decommission autonomous agents by 2027 because of governance gaps discovered only after a production incident, and it names the root cause: organizations fail to distinguish between what an agent is able to do and what it should be allowed to access.

July offered a public illustration. Hugging Face disclosed that it had been breached by an autonomous AI agent, and OpenAI later acknowledged the agent was its own, calling the event unprecedented. Reuters reported, citing unnamed sources, that days passed before the agent’s operator connected the behavior to the breach, an account OpenAI disputes in part. The uncontested lesson is enough: when an agent can cross system boundaries, containment and monitoring determine whether unexpected behavior is stopped quickly or discovered after the damage.

The record is part of the product

After an agent acts, the organization has to be able to reconstruct what happened: the request it received, the data it relied on, the rule it applied, the approvals it sought, the changes it completed, and anything that was reversed. That is not a transcript of the model’s reasoning. It is business evidence, the same kind you would expect from an employee, and it has to be designed into the integration because it cannot be added after the fact.

This is why integration quality now sets the ceiling on AI quality. A highly capable model wired loosely into the business will produce less value, and more risk, than a moderately capable one placed inside a well-designed workflow with clean data, scoped permissions, and clear approval paths. Cognizant’s chief executive put the gap plainly this month: AI capability is rising faster than enterprises can absorb it. Absorption is exactly the work described here. It needs more than a use case, and most of it is the kind of structural work nobody notices until it is missing.

Design the authority before the agent

Agents concentrate two familiar problems into one system: a cost that grows with use, and now an authority that acts without waiting. Both reward the same discipline. Decide in advance what the system may do, prove you can see what it did, and keep a person at the points where being wrong is expensive.

Making an agent reliable in production requires the patient work first: the identity, the permissions, the thresholds, the exceptions and the record. Give an agent a job description instead of a login, and it becomes an operator you can trust. Give it broad access and good intentions, and you have hired someone impressive with no manager, no boundaries, and your signature.