When AI Acts on Our Behalf, Who Do We Trust?

As AI agents move from generating recommendations to taking action, CIOs and CISOs must rethink digital trust.

Singapore, November 9, 2026 — Imagine an artificial intelligence (AI) system reviewing a supplier invoice, flagging a discrepancy and recommending whether payment should be approved. Now imagine an AI agent verifying the supplier’s details, accessing the organisation’s financial system and initiating payment itself. One supports a human decision; the other can move money and create real business consequences.

As AI moves beyond generating content and recommendations to executing tasks across business applications and workflows, organisations need to rethink what it means to trust the technology. AI agents promise greater efficiency, but their growing autonomy also raises questions about who they are, what they can do and who is responsible when something goes wrong.

The challenge, therefore, is no longer simply ensuring that AI produces reliable answers. It is establishing the conditions under which agents can act safely and legitimately.

Intelligence is not authority

Much of the conversation around AI security has focused on output quality, including accuracy, susceptibility to manipulation and potential bias. These concerns remain important, but the stakes change when AI moves from recommending an action to carrying it out. An agent accessing multiple applications, retrieving sensitive information and initiating transactions needs more than the technical ability to perform a task. It needs the right permissions and clear boundaries.

A reliable recommendation does not automatically make an agent trustworthy enough to act, just as access to a system does not authorise every possible action within it. Trust depends on knowing what an agent is, who is responsible for it, what it can access and whether its actions can be traced.

This is increasingly urgent across Asia Pacific, where KPMG finds that 61% of organisations are scaling AI or have reached more advanced stages of maturity. Singapore’s National AI Strategy 2.0, its Model AI Governance Framework for Agentic AI and the ASEAN Responsible AI Roadmap 2025–2030 reflect the region’s ambition to advance AI while managing its risks. For businesses, this means translating governance principles into practical safeguards before greater autonomy outpaces their ability to control it.

Give every agent an identity

A sensible starting point is to know what your agents are. Every AI agent operating within an enterprise should have a distinct, verifiable identity linked to an accountable owner, whether an individual, a team or the business function responsible for deploying it.

An agent may act on an employee’s instructions, retrieve information from one application and pass data to another service to complete a workflow. Organisations must distinguish between the person requesting an action, the agent carrying it out and the systems it accesses. Without that separation, identifying the source of an action becomes difficult, particularly when agents coordinate tasks with other agents.

Identity must also remain meaningful throughout an agent’s lifecycle. An agent initially designed for a narrow purpose might later gain additional responsibilities or access to new systems, changing its risk profile. Organisations need visibility into which agents exist, who owns them and what resources they can access, as well as processes to revoke permissions when an agent is retired.

Put boundaries around autonomy

Knowing an agent’s identity is only the beginning because its authority must also remain proportionate to its assigned task. This is where the principle of least privilege becomes critical.

In practice, this just simply means that an agent summarising customer feedback does not have the same permissions as one authorised to update customer records or process refunds. Access should reflect the sensitivity of the information involved and the potential consequences of an action, with time-limited permissions helping prevent unnecessary access from persisting.

The principle of least privilege also allows organisations to maintain control as an agent’s responsibilities expand. So, instead of automatically carrying forward its permissions the organisation reassesses those permissions. This is particularly pertinent for high-impact activities such as substantial payments or changes to sensitive customer information, which may also warrant human approval.

The aim is not to supervise every automated step, but to ensure that oversight reflects the risk involved. An agent’s ability to act should never exceed the authority it has explicitly been granted.

Accountability cannot be automated away

Even well-designed controls cannot eliminate every mistake, so organisations must be able to understand an agent’s actions and respond when its behaviour falls outside expectations. This requires auditable records of identities, access requests and consequential actions, supported by monitoring that can flag unusual activity or misuse of permissions.

Responsibility must also be established before deployment. Teams should know who can suspend an agent’s access, investigate an incident and determine when it is safe for the agent to resume operating. These measures belong within existing identity, cybersecurity and risk-management processes, rather than being treated as a separate exercise simply because AI is involved.

Build trust by proving the controls work

Too many organisations treat security as a matter of putting the right policies in place and assuming the technology will behave accordingly. With AI agents, that is not enough, especially as they gain access to business-critical systems and begin acting on behalf of employees and customers.

Organisations need confidence that their controls work in practice, not just on paper. That means ensuring every agent has a verifiable identity, clearly defined ownership and only the permissions needed for its assigned tasks. It also means being able to establish whose authority an agent is exercising, verify that each action falls within its remit and intervene when it does not. As agents, applications and permissions change over time, this cannot be a one-off exercise.

AI will continue to become more capable, and organisations should not have to choose between embracing that potential and protecting the business. But that is ultimately will separate the winners from the losers

Attributed to: Akkasha Sultan, Senior Vice President and General Manager for Asia Pacific and Japan (APJ) at Ping Identity