Sarthak Aggarwal frames enterprise agents as software workers that can read private context, make decisions and act under delegated authority. A useful demonstration is therefore different from operational readiness: each agent needs an owner, a defined subject it acts for, explicit capabilities, a governing policy and a way to revoke access. The talk distinguishes the real user or workload being represented from a ticket that merely provides delegation context.
Sarthak Aggarwal explains how untrusted emails, tickets and documents can steer a model toward actions that its credentials permit but its legitimate task does not require. The discussion contrasts an adversarial prompt-injection incident involving Microsoft 365 Copilot with a reported operational failure involving a Replit coding agent. The shared lesson is to constrain effective authority outside the model, rather than relying on the model to obey a written instruction.
Sarthak Aggarwal proposes separating planning from execution. Authenticated intent becomes a typed, logged plan describing the requested capability, subject, scope and duration. An executor can process evidence and propose tool calls, but a separate policy gate decides whether each action fits the plan and its allowed capabilities. Untrusted evidence may supply permitted parameters; it must not create new authority.
Sarthak Aggarwal illustrates the boundary with a password-reset ticket containing an instruction to disable multifactor authentication. A policy gate rejects the additional action because it falls outside the approved reset plan, then escalates and records the attempt. Short-lived capabilities should bind each permitted action to the actor, subject, intended service and expiration, while audit receipts retain the delegation, plan and requested action. Tool and agent communication protocols provide connections, but the enterprise still needs policy enforcement and revocation.
Watch on YouTube
