Your AI agent is logged in as you

Ninety days ago, "what is this agent allowed to do?" was not a product category. This week, three unrelated companies shipped answers to it within seven days of each other. When separate teams who are not talking to one another all reach for the same missing part at the same time, that is not a coincidence. That is an industry discovering it built the engine before it built the brakes.

Three shipments, one missing piece

First, JetStream launched Clearance, a reasoning engine that evaluates and authorizes every agent action before it executes. The interesting part is not that it can block a bad call. It is that it blocks bad sequences. Query the database, attach the result, send it to an external address. Each of those three steps is completely boring on its own. Strung together, they are the exact shape of a data leak. Most tooling today notices that pattern the morning after, in a log nobody opens.

Second, NIST published a paper with a title that sounds like a joke and reads like an autopsy: "Back to the Future: Why Agentic AI Needs a Strong Identity Foundation." Its finding is blunt. Most agent pilots hand their agents static API keys, long-lived bearer tokens, or, most often, simply run them inside a human user's account with that human's full permissions. We spent two decades building identity and access management to stop precisely this, and the first wave of agents walked straight back into it wearing our badge.

Third, Cloudflare launched Wallets for AI agents: stablecoin balances with programmable per-payment limits and merchant whitelists, built on the x402 protocol, with more than 20 companies already running agent-initiated payment flows. Agents can now spend money. Actual money.

The contractor and the key

Here is the whole problem in one picture. You hire a contractor to work on your house while you are at the office. Option one: you hand over your own front door key, the one that opens everything, and it works forever. Option two: you issue a code that opens the side door only, only on Tuesdays, only between nine and five, and the log records that the contractor came in, not you.

Almost every agent running in production today is option one. The permanent key. And when something goes wrong, when the wrong list gets emailed or the wrong record gets overwritten, the audit log does not say "the agent did it." It says your name. There is no delegation chain, so there is no way to prove otherwise. That is the part that should make you sit up. Not the security risk in the abstract, the attribution risk in the specific.

NIST's recommended chain is worth memorising because it is only five links: human identity, then explicit delegation, then a unique identity for the agent itself, then short-lived scoped credentials, then separate logging of human versus agent actions. Nothing exotic. It is the same discipline we already apply to employees, applied to software that now behaves like one.

The gap that is still open

The sharpest detail in the whole week is buried in the reporting on Cloudflare's wallets. The current controls cap individual payments. They do not cap sequences.

A limit on one action is not a limit on a thousand actions. Agents do not do things once. Doing things repeatedly, quickly, without getting bored, is the entire point of them.

An agent cleared for fifty dollars per transaction is not an agent that spends fifty dollars. Fifty dollars a time, unbounded, is a very different risk than fifty dollars total, and it is the identical failure mode that Clearance was built to catch on the data side. Anyone wiring up agent-initiated spend right now has a bug they have not met yet.

Standardised in the open, and fast

One more thing worth noticing: x402 has moved under Linux Foundation stewardship, following the same path the Model Context Protocol took. The permission and payment layer for agents is not being won by a single vendor and licensed back to everyone else. It is being standardised in the open, by a neutral body, at a speed that is genuinely unusual for infrastructure this consequential. That is good news, and it is worth saying out loud while it is still true.

Why this is landing now

Because agents stopped being demos. McKinsey's State of AI in 2026 found large enterprises scaling agents in one or more functions rose from 27% to 40% in a year. Smaller firms stayed flat at 22%. Capability was never the thing holding the second group back. Scaling agents requires someone to define permissions, someone to own the failure modes, and someone to maintain it after launch, and that is exactly the work the shipments above are trying to turn into infrastructure.

What to actually do

If you run anything agentic, three questions are worth answering this week, and none of them require buying a product.

• Whose account is it using? Inventory every credential an automation touches. Who owns it, what scope does it carry, when was it created, and does anything expire?
• Can your logs tell a human from an agent? If not, you cannot investigate an incident and you cannot prove you did not cause one.
• What sequences can it run? Not what single actions. Which chains reach an external send, an external write, or a payment? Those chains are the actual attack surface, and almost nobody has drawn them.

The capability argument about agents is basically over. They work well enough to be trusted with real systems and real money. The argument that replaces it is smaller, duller, and far more consequential: permission. Who granted it, how narrowly, for how long, and who can prove it afterwards. That is not a philosophical debate. It is plumbing, and this week three companies started selling pipes.