Podcast: Play in new window | Download
Subscribe: Apple Podcasts |
Every time Claude stops in the middle of a task to ask permission to open a file or read an email, I get two choices. I can allow it once, or I can allow it always. I click “allow once” pretty much every time. I understand that “allow always” would make things smoother down the road, but it also opens the door to the kind of mistake you can’t take back, and I’m not ready to hand over that much on faith.
Businesses are facing the same decision, just on a much bigger scale. Rishi Bhargava, co-founder of Descope, joined me on a recent episode of the TechSpective Podcast, and our conversation kept circling back to how much access an AI agent should get, and how it earns more.
Lessons From Driver-Assist Technology
Rishi compared it to the evolution of driver-assist technology, which is an analogy I’ve used myself. The first time you turn on adaptive cruise control, you don’t let the car roll up on the bumper in front of you while you check your phone. Your foot hovers over the brake while the car proves itself, and over time you relax.
I trust adaptive cruise control now, to the point that it’s become a problem when I rent a car that doesn’t have it, set the cruise, and realize this car has no intention of slowing down for the traffic ahead.
AI agents should earn access the same way. Rishi has been giving agents more access over time, but he still isn’t comfortable letting one into his email. “Once you have e-mail access, you have everything,” he said, since email is the reset button for nearly every other account.
Giving Each Agent Its Own Identity
Building trust gradually only works if you can tell the agent apart from the person who gave it the assignment, and that’s where a lot of organizations fall short. Many agents today run on system credentials or borrow the identity of the user who launched them. When something goes wrong, the logs can’t tell you who actually did what.
That takes me back to my days as a network admin, when we spent a lot of energy telling people to stop using shared accounts. If ten people log in to a server with the same admin credentials, the audit trail is useless. A shared agent used by a whole marketing team creates the same blind spot.
Rishi argues that agent identity has to be treated as “a first-class citizen,” with agents acting on a user’s behalf rather than as the user. In the model he described, each agent gets a unique identity, starts with limited default permissions, goes through an approval workflow, and leaves an audit trail for everything it does. When it needs more access, it asks, and someone with the authority to approve or deny it makes the call.
Accountability ends up shared between the IT and security teams who set the policies and the user who approves the agent’s task. That only works if the agent is visible in the first place, which is a challenge when employees are spinning up tools on their own. It feels a lot like the early days of BYOD and SaaS apps, when users moved faster than IT could keep up.
Where Trust in Agents Is Heading
I can see a day when I tell an agent it’s handled my email 150 times without a problem and it can stop asking. Rishi expects trust to keep growing, much like it did with cloud infrastructure, and he expects agents to get access to systems without ever seeing a password.
More trust doesn’t take the human off the hook, though. Whoever turned the agent loose is still responsible for what it does, even when the agent made the call on its own. Whether I’ll ever let an agent make payments on my behalf is another matter. I don’t see it right now, but I’m not sure I plan to die on that hill.
To learn more, watch or listen to the full episode:
