Imagine handing a new recruit the keys to the office, the customer database and the company mailbox before explaining which decisions they can make. A little generous for a first morning.

Yet something similar can happen when an AI assistant becomes an agent. Yesterday it drafted replies. Today it can send them, update a customer record or trigger another tool. The demonstration looks convincing. The question of who authorised what often arrives later.

On 26 October, IBM announced the general availability of Agent Identity, a service built around identifying agents, delegating authority and tracing their actions. It is a vendor announcement, not independent proof of effectiveness. But the problem it addresses deserves attention well beyond large enterprises: when software starts acting on your behalf, what exactly have you delegated?

A convincing reply is still only a reply

Consider a small Moroccan online retailer. An assistant reads customer messages and prepares answers about deliveries. So far, a person checks the answer and sends it. Now suppose the team wants the agent to handle routine requests itself.

That sounds like one improvement. It actually contains several decisions. May the agent read every order, or only the order concerned? Can it change an address? Issue a refund? Offer a discount? Forward an attachment to another service?

These are hypothetical choices, not claims about a particular retailer. They show why “manage customer service” is a poor operating instruction. It describes a department. It does not define authority.

An agent that correctly explains a refund policy has demonstrated one skill. An agent allowed to refund a payment has received a separate power. The first does not automatically justify the second.

The permission lives outside the prompt

Writing “never send anything without approval” is useful. Giving the same agent unrestricted sending access leaves the software carrying that instruction with a capability you meant to withhold.

Where the connected service permits it, give the agent an account or credential limited to the task. A draft-writing agent should be able to save drafts. A reporting agent may need to read records without changing them. If a connector cannot separate those operations, that limitation belongs in the deployment decision.

This principle is already present in joint guidance released by CISA and international partners on 1 May 2026: limit agent autonomy, avoid broad access to sensitive systems and maintain identity controls and oversight. The guidance provides a security baseline; it does not certify a particular product or establish Moroccan legal requirements.

What matters for a small team is whether it can enforce the boundary. If nobody can explain which credentials the agent uses, or remove its access without changing everyone’s password, the setup needs attention before it receives more work.

Approval should mean something

There is another tempting shortcut: add an approval button and call the process supervised.

But what does the person see before clicking? A label saying “update customer”? Or the current address, the proposed replacement and the message that prompted the change?

The second gives someone a decision to make. The first asks for confidence.

For our hypothetical retailer, a useful division might allow routine delivery replies from verified order data, send address changes for review and keep refunds outside the agent’s authority during the pilot. These boundaries should reflect the business and the connected tools. A team may reasonably choose a more cautious starting point.

Human review is most useful when it concentrates on consequential or ambiguous actions. Asking someone to approve every harmless lookup can turn supervision into a habit of clicking through. Asking for approval after a message has already been sent is simply too late.

A small team needs a small, readable record

Moroccan agencies, merchants and service businesses do not need to reproduce a multinational’s entire identity architecture before testing an agent. They do need someone who can answer a few ordinary questions.

What was the agent asked to do? Which records did it use? What did it propose or change? Who approved the action, if approval was required? How can the team stop it?

A short activity record can be more useful than a technically impressive log nobody reads. It should support investigation without becoming another uncontrolled copy of customer messages and personal information. Record enough to understand an action; decide deliberately what must be retained and who can see it.

The NIST AI Agent Standards Initiative, launched in February, includes work on agent security, identity and interoperability. It is an initiative, not a universal compliance stamp. For buyers, it is another reason to ask how an agent connects, receives authority and leaves a trace, rather than judging the product only by its conversation.

Start with work you can afford to get wrong

A useful first assignment has a clear finish line and a tolerable failure mode: classify incoming requests, prepare a weekly report or draft replies for review. Keep the initial scope narrow enough to inspect the result.

Then test the awkward cases. Two orders share a name. A customer asks for an exception. A message contains instructions that contradict the procedure. A tool times out after receiving a request. Does the agent stop, ask or repeat an action that might already have succeeded?

Measure the time saved after review and corrections, not just the time taken to generate an answer. An agent that produces ten minutes of cleanup for every five minutes saved has made work faster in a rather unhelpful direction.

As with other infrastructure choices, convenience deserves to be weighed against operational control. Expand the agent’s access when the evidence from the pilot supports it, one responsibility at a time.

Before the next demonstration, ask the person presenting it to show three things: the agent’s actual permissions, the approval step for a consequential action and the way to revoke access. A polished answer can impress a room. Those three details tell you much more about whether the system is ready to work.