Your AI Agent Wants the Company Credit Card. Let’s Talk Permissions.

A chatbot gives you a questionable answer. An AI agent with the wrong permissions can give your entire customer database a change of address.

That is the less glamorous side of the agent boom. Once software can read your inbox, update your CRM and call business tools, the question is no longer just “How clever is it?” It is “Who gave it permission to do that?”

This week’s AI news offers a useful clue about where the market is heading. Alongside the promises of autonomous work, vendors are racing to build identities, permission controls and ways to stop agents. The industry has discovered that hiring a digital colleague is rather different from leaving a very enthusiastic intern alone with the company credit card.

The productivity opportunity is real. So is the need for a sensible access policy. For Malaysian businesses considering their next automation project, that second part deserves attention before the first agent gets its own login.

The news: agents are getting both jobs and boundaries

On 21 October 2026, ServiceNow announced general availability of Arc, a personal enterprise agent designed to work across workflows, email, Teams and other productivity tools. The company says its governance platform and NVIDIA OpenShell can constrain what Arc does at runtime.

In the same announcement, ServiceNow described plans to connect its AI Passport credentials to NVIDIA’s software and hardware enforcement layers. The idea is to carry information about what an agent is allowed to access or execute, then enforce those boundaries where the work happens.

A day earlier, WorkOS examined cross-company agent sign-on: how an agent from one business proves its identity when working with another. Its analysis highlights a particularly awkward distinction. Knowing who an agent is does not automatically prove that every step in a chain of delegated work was authorised.

Put less ceremoniously: a valid visitor badge does not entitle someone to approve your payroll.

The readiness gap is worth looking at carefully

There is also fresh evidence that operational AI use can move faster than the systems supporting it. An EMA research announcement published on 21 October reported findings from 203 IT professionals and leaders at North American organisations with at least 1,000 employees.

In that survey, 71.9% reported broad operational AI adoption or a more advanced stage. Only 22.2% described their IT asset management function as AI-ready. IT asset management is the discipline of knowing what technology assets you have, how they relate and how they are managed. That becomes rather important when automated systems need accurate information about the tools and data they touch.

• 71.9%: broad operational AI adoption or a more advanced stage.
• 22.2%: IT asset management described as AI-ready.

The survey does not establish that the remaining organisations have insecure agents. It measures a specific readiness function, not breach rates, and it cannot tell us how Malaysian SMEs compare. What it does support is a sensible question: are your supporting systems keeping pace with the automation you are introducing?

“Can log in” and “may do this” are different questions

Three decisions tend to get bundled into the word access:

• Identity: which agent is making this request, and who owns it?
• Permission: what records, tools and actions may it use for this task?
• Approval: which actions still require a person to say yes?

An agent may need to read a supplier invoice. That does not mean it should change the supplier’s bank details. It may draft a customer reply without being allowed to promise a refund. It may prepare an order without being allowed to place one.

Good controls make those distinctions explicit. A prompt saying “please be careful” does not. Politeness is excellent office etiquette; it is a disappointing substitute for an authorisation check.

A Malaysian SME example: invoices without the accidental bank manager

Consider a hypothetical local distributor that wants an agent to process incoming supplier invoices. The business needs less data entry, not a new autonomous finance director.

A sensible first version would read invoices from a designated folder, extract the fields, compare them with purchase orders and prepare draft entries. It would flag mismatches for review. It would not release payments, edit bank details or browse unrelated staff documents.

The controls should live in the connected applications and tool layer, not only in the agent’s instructions. Give it a separate identity, limited access and a clear owner. Require approval for the consequential step. Keep a record of what it read, proposed and changed.

That last distinction matters when a document contains unexpected instructions. An invoice is evidence to process, not a new manager issuing orders. Treating external content as untrusted input is basic design discipline, even if the content arrives with a very convincing logo.

For document-heavy workflows, the sequence can be straightforward: extract, validate, review, then generate the output. The human review step should happen before a consequential action, not during the meeting about what went wrong.

Before you switch it on, ask these six questions

1. Who owns this agent? Name someone accountable for its purpose, access and retirement. “The IT team, probably” is not an owner.
2. What is the smallest useful job? Start with one bounded workflow and define a correct result. Avoid a brief that amounts to “improve the company”.
3. What can it read, write and send? Review these separately. Prefer scoped, short-lived credentials where supported; do not share a staff member’s everyday account.
4. What needs approval? Payments, bank-detail changes, deletions and external commitments deserve deliberate treatment. Set thresholds appropriate to the business.
5. Can we reconstruct an action? Record the agent identity, task, tool call, approval and result. Protect the logs too; an audit trail should not become a second copy of every sensitive document.
6. Can we stop it? Test credential revocation and paused execution. Also plan how to identify and repair completed changes: a stop button does not undo yesterday’s email.

Then run a controlled pilot with realistic failures: a missing attachment, an ambiguous invoice, an unavailable tool and a request outside the agreed scope. Success means knowing when to stop and escalate, not finding ever more imaginative ways around a boundary.

Governance is how you get useful autonomy

It is tempting to frame this as a choice between innovation and bureaucracy. In practice, clear permissions make it easier to give agents worthwhile work. If everyone knows the boundaries, a routine task need not wait for an anxious person to supervise every click.

Measure completed work, correction time and exceptions alongside speed. Our earlier look at cost per verified outcome explains why cheap activity is not the same thing as business value. An agent that saves ten minutes and creates twenty minutes of checking has mostly automated the movement of anxiety.

The interesting development this October is not merely that agents are becoming more capable. It is that the surrounding infrastructure is beginning to treat them as actors with identities, owners and limits.

For a business deciding what to do next, the starting point is refreshingly ordinary: choose one job, give the agent only the access that job requires, and make the consequences visible.

Let it earn broader permissions. The company credit card can wait.

---

Sources and editorial notes

• ServiceNow, 21 October 2026: Arc availability and planned NVIDIA governance integrations. Product capabilities and availability are vendor statements, not independent test results.
• WorkOS, 20 October 2026: agent-to-agent sign-on across identity domains. Technical analysis from an identity-platform vendor.
• EMA via PR Newswire, 21 October 2026: enterprise AI adoption and ITAM readiness research. The chart uses the public research announcement, not respondent-level data or a review of the full report.

Reporting checked on 22 October 2026, Malaysia time. The invoice scenario is illustrative, not a customer case study. The cover is an original AI-generated editorial illustration, not a product screenshot. The chart reproduces sourced survey percentages; it does not predict business results.