Sarthak Aggarwal frames enterprise agents as software workers that can read private context, make decisions and act under delegated authority. A useful demonstration is therefore different from operational readiness: each agent needs an owner, a defined subject it acts forAn AI agent identity is a persistent, verifiable identifier used to attribute messages, actions, permissions, and history to an agent., explicit capabilities, a governing policy and a way to revoke access. The talk distinguishes the real user or workload being represented from a ticket that merely provides delegation context.
Sarthak Aggarwal explains how untrusted emails, tickets and documents can steer a model toward actions that its credentials permit but its legitimate task does not requireA confused deputy attack tricks a system with legitimate authority into misusing that authority on behalf of a less privileged requester.. The discussion contrasts an adversarial prompt-injection incidentPrompt injection occurs when untrusted content attempts to redirect an AI system's behaviour beyond the authority of that content. involving Microsoft 365 Copilot with a reported operational failure involving a Replit coding agent. The shared lesson is to constrain effective authority outside the model, rather than relying on the model to obey a written instruction.
Sarthak Aggarwal proposes separating planning from execution. Authenticated intent becomes a typed, logged plan describing the requested capability, subject, scope and duration. An executor can process evidence and propose tool calls, but a separate policy gate decides whether each action fits the planAn agent permission boundary defines and enforces which resources and actions an automated agent is allowed to use. and its allowed capabilities. Untrusted evidence may supply permitted parameters; it must not create new authority.
Sarthak Aggarwal illustrates the boundary with a password-reset ticket containing an instruction to disable multifactor authentication. A policy gate rejects the additional action because it falls outside the approved reset plan, then escalates and records the attempt. Short-lived capabilities should bind each permitted action to the actor, subject, intended service and expiration, while audit receipts retain the delegation, plan and requested actionAn AI audit is a structured examination of an AI system's design, operation, controls and outcomes against defined requirements or risks.. Tool and agent communication protocols provide connections, but the enterprise still needs policy enforcement and revocation.
Watch on YouTube
