AI agent
Your AI Agent Has No Manager
AI agent identity in consumer products
Enterprise identity reviews user access on a schedule. Consumer identity never had to, and personal AI agents just inherited that.
Open your connected apps page like Google, Apple or GitHub. Can you count how many services are connected, and how much of your data each one can reach? Somewhere in that list is something you authorized a while ago for a reason you have forgotten, and it still holds exactly the access you gave it.
Nobody has reviewed it. Not the company holding your account, and not even you.
What identity means
Identity used to mean proving who you are. With AI agents, the definition has shifted to what you do: the gap between what something was declared to be and what it is observed to do, ideally watched continuously rather than checked once.
(source: https://stytch.com/blog/what-is-rbac/)
Consumer systems declare once, on the screen where you approve a list of permissions. After that, nobody observes.
That was enough while the third party authorization was a passive integration, something that read and shared data when told to.
What changed is who decides
Now, an AI agent decides when to act, and what acting means. The permission it holds has shifted from access to decision.
And that shift required no new decision from anyone. The scope was already approved: read the mailbox, send as you, edit the files, post to the account, delete. Same grant, same scope, same consent screen from whenever you approved it.
Only the actor changed, and the actor was the one thing that scope quietly assumed.
Enterprise identity has the middle manager
In a closed enterprise, the identity lifecycle has three steps: join, move, leave.
The middle step is the one that matters. Roles change, teams change, projects start and end, and permissions follow. Someone compares what was granted against what was actually used, on a schedule, and closes the gap.
The company decides what an employee may reach, and the company is accountable when it gets that wrong. Someone other than the user owns the boundary, and that boundary is imposed.
Consumer identity has no owner
Now ask who does that job in a shopping app, on a social platform, or anywhere you signed up with an email address. The account lifecycle only has two steps: join, leave.
When an AI agent is navigating in those apps, the person accountable for its boundary is the end user. They approve their own scope once, at the moment they authorize it, and nothing is scheduled to re-examine it. No role change triggers a review, because there is no role.
The only candidate for the middle manager is the same person the boundary is meant to constrain, who is also the one who set the agent running. So the boundary here is offered rather than imposed.
Enterprise access control works because the system enforces it. Consumer access control has to be accepted and get awareness first.
The one control that does exist is the connected apps page, the entire consumer equivalent of the middle step, and it runs on the assumption that you will spontaneously decide to visit it again.
You cannot just ask more often
Cookie banners trained an entire population to click through without reading. The SSO consent screen made people hit accept all rather than tick boxes one at a time, because nobody can be bothered to evaluate each line. The prompts still exist and still technically ask. An agent permission screen inherits that reflex on the day it ships.
So the scarce resource is not consent. It is attention. You get a handful of interruptions across the whole relationship, and every one spent on something trivial is one you cannot spend later on something that matters.
Importing the enterprise's imposed boundary does not work here. Asking the user to review more often does not work either. And nobody else is assigned to.
When the manager does not exist…
None of this argues against delegation. Handing work to an agent is useful, and I do it every day. The question is not whether to let agents act for us, but what has to be true before we do.
So the problem with consumer agent permissions is not that they are too broad. The problem is that nobody is accountable for looking at them again. Your AI agent does not have too much power. It has no manager.
You cannot hire one either, so the job falls to you. Which is exactly why it cannot be left as your problem alone.
If a company ships a grant that an agent, or any connected app, can hold, it should be liable for making that grant manageable: findable, legible, and revocable by the person who signed it. You decide what your agent may do. The company should be answerable for whether you can ever revisit that decision.
That job is yours whether you want it or not. Making it possible is the least a company can do, and that is a design problem before it is a policy one.