Your AI agent needs a passport, a wallet and a boss

Access our original article in our Medium: https://luisyanguas22.medium.com/your-ai-agent-needs-a-passport-a-wallet-and-a-boss-081f44aec8b4

Today we all agree that an AI agent is not just a chatbot that gives you an answer, but something way more powerful. An agent in our days can do things like reading information, call APIs, update records, send messages, execute workflows and make decisions all along the way, with a surprisingly simple question coming up: If an AI agent can act like an employee, shouldn’t we be managing it a bit like one?

When a new employee joins a company, a couple of more or less standardized steps follow…He basically first gets an identity, an email address and then someone decides which systems he can access. But it’s always this someone who decides what the new employee is allowed to do, so someone is ultimately responsible for him, and when this employee finally leaves its job, his access is removed and chapter closed.

It sounds boring, of course, but this boring stuff is the foundation of what we’ve always considered as enterprise security.

Now imagine hiring an employee who can work 24 hours a day, every single day of the year without a single holiday, access ten systems simultaneously, make decisions in seconds and potentially launch thousands of actions before anyone notices something has gone wrong…Well, this is actually happening and is called agentic enterprise.

So to go deeper in the issue, we should begin by noticing that the problem is that our traditional security systems were mainly designed around two categories: humans and machines, a place where humans have identities, roles and permissions, and machines have service accounts, API keys and predefined access. But AI agents don’t fit comfortably into either category and they can behave like machines because they operate through software and APIs, but they can also behave differently from traditional software because they decide how to use the permissions they have, and this is for sure a big challenge.

To name just some examples of companies taking action, Microsoft is already introducing dedicated “agent identities” so organizations can identify and govern AI agents alongside other enterprise identities, and IBM has similarly argued that identity is becoming a foundation for securing the agentic enterprise. All this may sound like an infrastructure problem but is actually a business problem.

A real example we recently came along was a company with an AI agent connected to their transport management system. This agent did amazing things like detecting that a delivery was going to be late, checking alternative carriers, comparing prices, finding available capacity, updating the shipments and even sending emails to customers. All of them fantastic things. The issue came with the capacity the agent had to approve carrier changes up to a specific amount of money. This part was badly designed with slightly incorrect instructions so over time the system became prone to misunderstand specific situations and therefore some chaotic scenarios happened that made the whole use of agents a bit question mark.

So suddenly, with AI agents you might find out that your clever automation isn’t just answering a question but is actually spending your money or managing a key fundamental part of your business incorrectly, and this is why the next generation of enterprise AI will require something more sophisticated than simply giving agents access to company systems. They will need boundaries.An agent needs to know who it is.

It needs to know who it is acting for and what it is allowed to access, or what it is allowed to change. And perhaps most importantly, the company needs to know exactly what it did afterwards, because if an employee makes a mistake, you can usually ask them what happened, but with an AI agent, the question becomes much more complicated.

Which user authorized the action? Which agent performed it? Which tools did it use? What information did it access?What instructions influenced the decision? Which system did it change and why?

Recent guidance on agentic AI governance is increasingly focused on precisely this problem because we basically realised that identity alone is not enough and that organizations also need runtime controls over what agents can actually do. Akamai, for example, describes the shift as moving from simply verifying who has access toward governing the behavior of autonomous systems across APIs and workflows.

And speed is also another complicated problem, because while a human employee might accidentally delete one customer record, an AI agent could potentially make the same mistake across thousands of records in seconds, and that is both the magic and the danger of automation. The faster software becomes at taking action, the less useful traditional “we’ll check it later” controls become.

This is why concepts such as least privilege access, approval gates, audit trails, monitoring and real time policy enforcement are becoming increasingly important in AI software architecture. Cisco’s September 2026 research, for example, found that more than half of surveyed enterprises were already running agentic AI systems in production, while more than two thirds said detailed explainability for agent driven actions was important. In other words, companies are already giving AI more autonomy, but now they are also discovering that autonomy needs infrastructure, which brings us back to the passport, the wallet and the boss in the title of this article. The passport is the agent's identity, the wallet represents its ability to spend resources (money, computing capacity, API calls or other valuable things), and the boss is the human or organization ultimately responsible for what the agent does.

That does not mean of course that every AI agent needs an actual credit card and a manager sitting behind it, but in our opinion it means we need to start designing AI systems with the same basic principle we use for employees, one where authority should be explicit and never automated. An agent should not automatically receive every permission available to the person who created it, but it should receive the minimum authority required to perform its job, and that authority should be reviewable, traceable and revocable.

All this becomes even more important as agents start connecting to other agents, a situation where one agent may ask another agent to perform a task, and then that second agent may access another system, which triggers another workflow…Suddenly, one seemingly simple request can create a chain of autonomous actions across an entire technology stack, and that is where software architecture becomes incredibly important.

So the future of AI in business will be about designing the systems around the models. We should create unavoidable barriers as how does the agent authenticate? how does it access company data? which APIs can it call? what happens when it wants to perform a high-risk action? where is the human approval required? how do we monitor it and how do we stop it?

At this point in time these are not theoretical questions anymore but they are becoming part of normal enterprise software development, and perhaps that is the most interesting thing about the current AI revolution. The difficult part may no longer be teaching software how to think, but may be teaching software how much authority it should have when it does.

If your company get this right, you will be able to build remarkably powerful AI systems without simply handing the keys to the kingdom to a machine, because giving an AI agent access to your business is easy, but giving it the right access is purely software engineering.