Jared Kaplan, a leading AI scientist from Anthropic, was recently quoted in The Guardian suggesting that humanity will have to decide by 2030 whether to let AI systems train themselves. While he frames this as a future decision, my perspective is that we must face this question today, not in the 2030s.
As governments and organizations rush to deploy AI agents, we are already granting them significant access to our data, customer relationships, and critical services. If we agree to let these agents operate within our systems, we must stop thinking of them as mere "tools" and start treating them like employees.
This means establishing a clear governance framework for our new digital workforce. Every AI agent needs:
- A Digital Identity: A clear, manageable credential, just like for a new hire.
- Clear Privileges: Defining what data it can access and what actions it can take, based on the principle of least privilege.
- An Authorization Lifecycle: A process to grant, manage, and instantly revoke its access when a role changes or a security event occurs.
These seemingly "boring" topics—authentication, authorization, and identity—are the foundation that will determine whether a world of AI agents is productive and secure or chaotic and risky. We aren't just building features; we are designing the operational and security protocols for a new kind of workforce.