AI agents have a permission problem.

We’ve spent the last few years making AI models increasingly capable. They can write code, analyze documents, operate software, make decisions and coordinate complex workflows. The next step is obvious: Let them actually do things. And that is where the interesting problem starts.

Giving an AI agent access to an API is technically easy. Giving it access to a payment system, a production environment, a customer database, an ERP or a critical business workflow is something completely different.

The question is no longer: “Can the AI do this?” It becomes: “Should the AI be allowed to do this?” And even more importantly: “Who decides?”

Today, authorization is usually designed around humans and applications. A human has a role. A system has permissions. An application has access scopes. An autonomous agent is different. It can reason, change its plan, call different tools and potentially take a sequence of actions that nobody explicitly approved one by one. That creates a new boundary in enterprise architecture. The model can remain probabilistic. The execution cannot.

An agent might decide that it wants to make a payment. The model should not be the component deciding whether that payment is permitted. The execution layer should. It should be able to deterministically answer: ALLOW. REQUIRE HUMAN. BLOCK. And when something actually happens, there needs to be verifiable evidence of what was requested, what policy applied, what authorization decision was made and what was executed.

This is why I increasingly think the conversation around “AI safety” in enterprises needs to move closer to the execution layer. Not just: “How do we make the model safer?” But: “How do we make autonomous execution controllable?” Because enterprises are not going to stop using increasingly autonomous AI.

The real challenge is making autonomy compatible with accountability. That is the problem I’m working on with Hardalion and Nexus. We’re building around a simple principle: AI can decide what it wants to do. The execution boundary decides whether it is allowed to happen.

I think this boundary is going to become one of the most important pieces of enterprise AI infrastructure.

And we are still very early.